Greenhouse Software Trust Center | Powered by Conveyor

·Oct 22, 2026, 15:45 UTC

·Response to the PHP2Shell vulnerability (CVE-2026-109618 / CVE-2026-109619)

·We have assessed our product infrastructure and have found no exposure to this vulnerability. We maintain monitoring across our environment and have put additional detection and protective measures in place as a precaution. We are also working with relevant third-party vendors to confirm they are assessing and mitigating their own exposure. Jun 24, 2026, 12:55 UTC

·Response to Klue Third-Party Security Incident

·We were recently notified that Klue, a third-party vendor, experienced a security incident in which attackers obtained the credentials Klue used to connect to certain Greenhouse business systems. Based on our investigation to date, the unauthorized access occurred on June 11, 2026, was scoped to Klue's integration, and did not involve Greenhouse's own infrastructure.

·No Greenhouse product, hiring, or candidate data was affected. The data accessible was limited to business contact information held in our sales and customer relationship systems, specifically names and contact details, and our investigation has not identified any modification or deletion of data.

·We acted quickly to secure unauthorized access, notified the relevant data protection authorities, and are working directly with Klue as its investigation continues. Feb 26, 2026, 13:55 UTC

·Greenhouse achieves ISO 42001 Certification

·Responsible AI you can trust. Greenhouse is now ISO/IEC 42001:2023 certified, the global standard for Artificial Intelligence Management Systems (AIMS).

·This certification independently validates our commitment to developing AI with accountability, fairness, privacy, and security at its core.

·As AI adoption accelerates in hiring, so do expectations around oversight, accountability, and risk management. We are proud to provide customers with AI they can trust today and as regulatory expectations continue to evolve. Dec 17, 2025, 13:55 UTC

·Response to CVE-2025-55182 (React2Shell)

·Upon receiving a threat advisory on 12/03/2025 regarding CVE-2025-55182, Greenhouse immediately deployed a virtual patch to our WAF to mitigate risk while investigating impact. Although we confirmed the specific vulnerable features were not in use, we proactively upgraded and validated all affected dependencies to the vendor-recommended versions. We have completed deployment and retained our protective WAF rules to ensure ongoing security.