Trust Center
Product security resources
Security bulletins
Get the latest updates on security vulnerabilities and incidents, including detailed impact analysis and resolutions.
CVE database
Access our centralized repository of product vulnerabilities (CVEs) with associated impact assessments and fixes.
Vulnerability disclosure policy
Learn how to responsibly report potential security vulnerabilities and how our team manages and responds to disclosures.
Report a security issue
Submit security vulnerabilities or incidents to the Everpure security team for prompt review and resolution.
Certifications
ISO 27001 Certificate
ISO 27001 certifies our rigorous, independently audited controls to protect customer data and keep systems secure.
SOC 2 Type II Report
SOC 2 verifies our strong internal controls to ensure the security, confidentiality, and availability of our platform.
SOC 3 Report
Report on Everpure System and Pure1® Edge Services for security, availability, and confidentiality.
FIPS 140-3 Certificate //FA
Everpure aligns with NIST cybersecurity standards, meeting NIST FIPS 140-3 for data protection and compliance.
FIPS 140-3 Certificate //FB
Everpure aligns with NIST cybersecurity standards, meeting NIST FIPS 140-3 for data protection and compliance.
Common Criteria //FA
Common Criteria certifies our products meet rigorous global security standards for government and defense assurance.
Common Criteria //FB
Common Criteria certifies our products meet rigorous global security standards for government and defense assurance.
IPv6 //FA
IPv6 Ready certification confirms FlashArray meets global IPv6 standards for secure, interoperable networking.
IPv6 //FB
IPv6 Ready certification confirms FlashBlade meets global IPv6 standards for secure, interoperable networking.
VPAT Report //FA
Our VPAT outlines how we meet accessibility standards, ensuring our technology is inclusive for all users.
VPAT Report //FB
Our VPAT outlines how we meet accessibility standards, ensuring our technology is inclusive for all users.
ProcessUnity CyberGRX Report
Access our CyberGRX profile for a validated third-party risk assessment that streamlines vendor due diligence.
Product support and security resources
Product support
Find answers to your technical questions and learn how to use our products.
Product security
Explore product security resources, including the CVE database, security bulletins, certifications, and customer security support.
Alerts and Advisories
0
1
Featured security resources and insights
SOLUTION BRIEF
Unlock Enterprise AI with Everpure Data Intelligence
Turn fragmented enterprise data into trusted, contextual, governed, and AI-ready intelligence.
ANALYST REPORT
The State of Cyber Resilience
Ponemon Institute surveyed 610 IT security practitioners on their storage security approach. See the findings.
BLOG
Ransomware Recovery: How to Evaluate Storage Beyond Security Claims
Learn how to evaluate whether a storage platform truly delivers ransomware resilience with capabilities like immutable snapshots and rapid restore—or only claims to.
BLOG
Recovery Is the New Backup
Move beyond checkbox routines to a tiered, recovery-first cyber resilience strategy that restores clean, trusted data fast.
BLOG
How PSIRT Uses AI to Improve Customer Security
Discover how Everpure's Product Security Incident Response Team (PSIRT) uses AI to prioritize vulnerabilities, assess risk, and improve customer security guidance.
BLOG
Beyond the Bulletin: Fleet Telemetry in Action
See how Everpure's PSIRT uses fleet intelligence to speed remediation and strengthen your security posture.
Security assurance
Connected detection
Stay ahead of threats with native detection, tightly integrated to SecOps, for automated remediation.
Data availability with layered resilience
Safeguard data with SafeMode™ Snapshots, fast recovery, and redundancy for cyber resilience.
Governance and continuous assurance
Explore how Everpure unites risk, compliance, and monitoring to meet global standards like ISO 27001, OMB M-22-18, and NIST SP 800-218A.
Data and privacy protection
Learn how we protect privacy with data minimization, encryption, and GDPR/CCPA compliance
Embedded security in the development lifecycle
Read how we build security into SSDLC (Secure Software Development Lifecycle) with secure coding, threat modeling, and continuous vulnerability testing.
FAQs
Do you undergo regular third-party security audits or penetration testing?
The Everpure Security team partners with reputable third-party security firms to perform specialized penetration tests across our infrastructure, products, and services, including Everpure FlashArray™, FlashBlade®, and cloud environments on an annual basis. Tests cover web applications, product features, code reviews, and threat modeling, thereby driving a robust security posture. Penetration test reports are available to customers upon request, subject to a mutual non-disclosure agreement (NDA).
How is access to customer data restricted and monitored?
Everpure does not process, store, or transmit customer data. Arrays are on-premise storage platforms that will remain under the customer's control. However we do receive system health and telemetry data which is stored in Pure1.
How do you encrypt data at rest and in transit?
All data is encrypted with AES 256-bit encryption. This encryption is done at the firmware level and is not hardware dependent. Our data encryption occurs without impact on performance and while maintaining full data reduction capabilities.
FlashArray and FlashBlade encryption is FIPS 140-3 certified, NIST compliant, NIAP/Common Criteria validated, and PCI-DSS compliant. The efficacy of our data encryption and data erasure have been validated by Kroll OnTrack—one of the industry’s leading security firms.
How do you detect, respond to, and communicate security incidents or breaches?
Everpure detects security incidents through continuous monitoring of all arrays, which report back to the Pure1 cloud-based monitoring system every 30 seconds with detailed telemetrics, and every hour with a full activity log. This real-time data enables proactive identification and resolution of issues. The Incident Response Program promptly identifies, declares, and responds to security incidents, managed by our Security Operations team.
In the event of a confirmed security incident or data breach, Everpure notifies customers in writing no later than 72 hours after becoming aware of the incident, including incidents where data is accessed by or disclosed to an unauthorized party, and follows an established Incident Response Procedure as per contractual agreements.
Do you support Single Sign-On (SSO), MFA, or integration with identity providers (Okta, Azure AD, etc.)?
Yes. Everpure supports Single Sign-On (SSO) as the primary application portal, which requires multi-factor authentication (MFA). Multi-Factor Authentication is supported via RSA SecureID, and all applications published by Everpure IT require MFA. Pure1 provides SSO using SAML and can be integrated with the customer's Identity Provider. Purity OE supports SAML2-based SSO integration with Microsoft Active Directory Federation Services (AD FS), and SSO integration can optionally include MFA such as through a certificate or Microsoft Azure authentication. FlashArray supports SAML2.0, LDAP, and Active Directory integration for authentication and role-based access control. Administrative accounts can be integrated with Microsoft Active Directory or OpenLDAP, enabling granular administration and role assignment.
Committed to your protection
Join the Everpure community
The Everpure Community connects customers, partners, and experts to share knowledge, get support, and learn together.
Get Security Support
Contact the Everpure Security team for questions, concerns, or reports related to security vulnerabilities, incidents, or disclosures.
Personalize for Me
My Updates
No updates at this time.