Trust - NinjaOne

Trust Center

Security at NinjaOne

Security is built into the fabric of our products, team, infrastructure, and processes, so you can be rest assured your data is safeguarded.

Security Updates

PHP Vulnerabilities

October 21, 2026

NinjaOne’s security team is aware of the PHP vulnerabilities reported on October 21, 2026, specifically CVE-2026-109618 and CVE-2026-109619.

There has been no impact on customers, customer data or systems, or any NinjaOne data or services to date. NinjaOne is not exposed or at risk given the reported vulnerabilities.

NinjaOne continues to be vigilant and monitor for ongoing threats and vulnerabilities to all of our systems and services. Customers and their data security remain NinjaOne’s top priority.

eMudhra Certificate Update

October 17, 2026

On October 17, 2026, it was reported that the private keys behind eight intermediate certificates issued by eMudhra, a certificate authority (CA), had been compromised. In response, Mozilla, Chrome, Apple, and Microsoft are removing trust in the affected root, and NinjaOne is doing the same in the NinjaOne agent.

This is an industry-aligned precaution and not a NinjaOne security incident. Most customers will see nothing. For customers who use eMudhra certificates, we strongly suggest you replace them.

Compliance

DORA

FedRAMP High – Ready

TX-RAMP

GovRAMP

FedRAMP Moderate – Authorized

NIS 2 Directive

GDPR

CCPA

SOC 3

HIPAA

SOC 2

ISO 27001:2022

Resources

Controls

FedRAMP Moderate

FedRAMP Moderate

AI

Ethical Use of AI & Internal Policy
Managing AI Vendor Security
AI/ML for Data Excellence

+ 1 more

Product Security

Application Program Interface (API) / Integrations
Role-Based Access Control (RBAC)
SSO

+ 2 more

Information Security

Data Classification
Data Storage
Asset Inventory

+ 7 more

NinjaRemote

Enhanced encryption and secure communication for NinjaRemote backend operations

Network Security

Network Security

Organizational Security

Change Management
Asset Inventory
Asset Management

+ 3 more

Privacy

Data Processing Agreement

Incident Management & Response

Data Breach Notification
Incident Response Plan (IRP)

Business Continuity & Disaster Recovery

Recovery Time Objective (RTO) / Recovery Point Objective (RPO)
Disaster Recovery Plan
Business Continuity Plan

Infrastructure

Physical Access Control – Data Center
SOC 3 – Data Center
SOC 2 Type II – Data Center

Threat Management

Antivirus and Malware
Risk Management
Penetration Testing

+ 2 more

Third-Party Service Providers / Subprocessors

Third Party Risk Management (TPRM)
Third-Party Service Providers / Subprocessors

Accessibility Statement

NinjaOne is committed to making our products accessible and user-friendly to everyone. That’s why we’ve partnered with a third-party to perform accessibility assessments against the Web Content Accessibility Guidelines (WCAG) 2.2 AA / Voluntary Product Accessibility Template (VPAT) 2.5 standards for major products and functionality. In our most recent testing, the NinjaOne core platform achieved “Supports” or “Partially supports” for all applicable WCAG 2.2 criteria. Our VPAT reports are available to customers or prospects upon request.

As we develop and release new products and features, we conduct ongoing accessibility testing to identify potential compliance gaps. We are committed to making commercially reasonable efforts to resolve these issues based on their severity and the scope of the changes they require. We also incorporate accessibility objectives into our regular release planning and prioritize them alongside other development initiatives. Your feedback helps us ensure our solutions are accessible and aligned with your specific module usage and assistive technology needs. We recognize that accessibility is a priority for the NinjaOne community and are committed to incorporating these requirements into our broader product roadmap.

For questions or suggestions, please contact your account team or email us at  [email protected].

Subprocessors

Exypnox

Technical Support Services

Philippines

Amazon Web Services

Cloud Infrastructure/Hosting

USA, Canada, Germany, Australia

Zendesk

Cloud Support Services

USA, Germany, Ireland, Australia, Japan

Sentry

Troubleshooting and Debugging

Google Cloud Provider

Cloud Services and Fraud Prevention

USA, GCP EU-multi region

Panther Labs

Security Information and Event Management

USA, Germany, Australia

Anthropic

Enterprise AI Services for Technical Support

USA, Canada, Germany, Australia, Ireland, UK, Singapore, Japan

FAQ

What types of PII data are stored in NinjaOne?

NinjaOne does not typically process personal and/or sensitive data, please refer to our DPA for more details. The solution collects computer information (e.g., computer name, hardware type, local IP address, file structures, etc.).

Does NinjaOne have written policies, procedures and/or processes in place to ensure the proper management and supervision of staff for the preparation, review, execution of your operations?

Yes

Is NinjaOne GDPR compliant?

Yes

Does NinjaOne have a documented Information Security Policy?

Yes