- When using Deputy AI, where is my data processed?
- Can Deputy AI act on its own without my initiation or approval?
- Does Deputy AI respect my existing user permissions?
- What employee data does Deputy AI access to perform its tasks?
- What happens if Deputy AI makes a mistake?
Trust Center Updates
PHP Critical Vulnerabilities (CVE-2026-109618/109619)
On October 21 2026, Deputy became aware of critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) and preemptively deployed available virtual patches to the next-generation web application firewall as soon as they became available to thwart potential malicious requests.
We then promptly deployed necessary PHP patches across our environment as soon as they became available.
Based on our current assessment, we are not aware of any risk to Deputy services and customer data from these vulnerabilities.
We continue to monitor our systems and have not identified any evidence of compromise. No action is needed from Deputy customers or users.
More information about these vulnerabilities can be found on the following Government agency sites:
ASD - Australian Signals Directorate
On October 21, 2026, two remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619 - both carrying a CVSS 4.0 score of 9.2) affecting PHP versions 5 through 8 were publicly disclosed. We engaged our Security Incident Response Team (SIRT) and are actively patching internal systems.
Keyv npm Supply-Chain Compromise
On August 4, 2026, several npm packages in the keyv/cacheable ecosystem were compromised, resulting in the publication of malicious package versions.
Deputy has assessed its dependencies and build systems and confirmed that no affected package versions were introduced into our environment. Our systems and customer data have not been impacted by the events.
As this campaign is still developing, we are continuing to monitor published indicators and will update this notice if our assessment changes.
New SOC2 Type 2 report available
We are pleased to announce the successful completion of our latest SOC 2 assessment and the receipt of our official attestation report. You may now request a copy of the new report directly through this Trust Center.
Deputy not impacted by React Framework
Deputy is aware of the recently announced critical vulnerability affecting the React framework and React Server Components (RSC). Deputy does not use this framework or vulnerable components, and its systems have not been impacted by the events. While we are not impacted, our teams are monitoring the situation.