Question 1

Is Qumulo SOC 2 compliant?

Accepted Answer

Qumulo is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Question 2

Is Qumulo GDPR compliant?

Accepted Answer

According to Qumulo's public trust center, Qumulo is GDPR compliant. On SOC2C this listing is Listed.

Question 3

Is Qumulo HIPAA compliant?

Accepted Answer

According to Qumulo's public trust center, Qumulo is HIPAA compliant. On SOC2C this listing is Listed.

Question 4

Is Qumulo SOC 2 Type I or Type II?

Accepted Answer

Qumulo is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Question 5

Can I use Qumulo's SOC 2 for a vendor risk assessment?

Accepted Answer

Yes. Qumulo's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Question 6

Is Qumulo penetration tested?

Accepted Answer

Qumulo hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Question 7

Can I get Qumulo's SOC 2 report?

Accepted Answer

Qumulo's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Question 8

Is Qumulo secure?

Accepted Answer

Security isn't a single yes/no, but Qumulo is SOC 2 Type II compliant and holds SOC 2 Type II, GDPR, HIPAA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Question 9

Does Qumulo have a bug bounty or vulnerability disclosure program?

Accepted Answer

Qumulo hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@qumulo.com or via a /security page (Qumulo lists a security contact).

Question 10

Who are Qumulo's subprocessors?

Accepted Answer

Qumulo lists 14 subprocessors on its trust center, including Microsoft Azure, Datadog, Google Workspace, Okta, PagerDuty. Buyers use this for fourth-party risk review.

Question 11

Where does Qumulo host or store data?

Accepted Answer

Qumulo hosts on Azure, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.

Question 12

Where is Qumulo's trust center or security page?

Accepted Answer

Qumulo's trust center is at https://trust.qumulo.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Question 13

Do you encrypt data at rest?

Accepted Answer

Yes. All file data is encrypted at rest by default in Qumulo version 3.1.5 and higher.

Question 14

Do you support Single Sign-On (SSO)?

Accepted Answer

Yes. SSO and MFA is available on Qumulo Core 5.2.5.1 and higher.

Question 15

Do you have access to the data I store on my Qumulo instance?

Accepted Answer

No, Qumulo does not have access to your file data. If you enable Cloud Based Monitoring for your cluster, Qumulo will collect metrics about the health of your cluster. If you enable Remote Support, Qumulo support engineers will have access to your cluster and the logs necessary to troubleshoot and resolve issues, but not your file data.

Question 16

How do you handle secure data deletion?

Accepted Answer

Qumulo has media disposal procedures and policies, and the lifecycle management company we utilize provides certificates of destruction for required resources. Disk retention is available for customers with on-prem deployments who wish to retain and destroy old disks according to their own data deletion policies and practices. For cloud offerings in AWS and GCP, please review their data destruction statements. For the Azure Native Qumulo managed service, the Azure data-destruction statement is available here.

Question 17

How do you back up my data?

Accepted Answer

Qumulo does not back up and restore customer data. Customers can manage backup and recovery of their Qumulo instance according to your enterprise BC/DR policy. For customers who require support for immutable point-in-time data, Qumulo ships with Snapshot Locking and Replication functionality that can be set to your specifications based on your data handling policies. These features ship as part of your standard Qumulo software subscription at no extra cost to you, and support many use cases, such as litigation holds, business continuity and disaster recovery, and ransomware protection.

Question 18

How can I get a full SOC2 Report?

Accepted Answer

Qumulo's SOC 2 report is available via the Resources section on this Trust Center. You may be asked to sign an NDA prior to accessing documentation containing confidential information. Please contact [security@qumulo.com](mailto:security@qumulo.com) with any questions or difficulty accessing the resources you need.

Question 19

Has Qumulo assessed the "SMB Signing not required" finding reported by my vulnerability scanner?

Accepted Answer

Some vulnerability scanners report that SMB signing is not enforced by default on Qumulo storage clusters. This is a configuration setting, not a software vulnerability. Qumulo's SMB implementation fully supports both SMB signing and SMB encryption. Whether SMB signing is required is controlled by cluster policy settings and can also be enforced through Active Directory Group Policy. Customers whose security policies require SMB signing can enable it through Qumulo's cluster SMB configuration or by enforcing it via Group Policy on domain-joined clients. For detailed guidance, please contact your Qumulo account team. No software update is required to address this finding.

Question 20

Is Qumulo affected by CVE-2026-31431 (Copy Fail)?

Accepted Answer

CVE-2026-31431 is a vulnerability in the Linux kernel's `algif_aead` cryptographic subsystem. The vulnerability, publicly known as "Copy Fail," could allow a local, authenticated attacker to impact the confidentiality, integrity, and availability of an affected system. It has a CVSS v3.1 base score of _7.8 (High)._ Qumulo assessed this vulnerability and determined that, while the affected kernel module was present in the underlying operating system, Qumulo's architecture limits the practical exploitability of this issue. The attack requires local access and an authenticated user with existing privileges on the node, conditions that are not typical in standard Qumulo deployments. Resolution: Qumulo Core version 7.8.4.3 mitigates this vulnerability by disabling the `algif_aead` kernel module. Customers running Qumulo Core 7.8.4.3 or later are not affected. Recommended Action: Customers should upgrade to Qumulo Core 7.8.4.3 or later. If you have questions or need assistance with the upgrade, please contact Qumulo Support.

Question 21

Is Qumulo affected by CVE-2026-43284 ("Dirty Frag"), the Linux kernel privilege escalation vulnerability?

Accepted Answer

Qumulo is aware of CVE-2026-43284, a Linux kernel vulnerability in the IPsec ESP and RxRPC subsystems that can allow local privilege escalation. This vulnerability has a CVSS v3.1 base score of 8.8 (High) and requires an attacker to already have local shell access to the system. Qumulo rates this vulnerability as Low risk for our platform. The affected kernel subsystems (IPsec ESP and RxRPC) are not used by Qumulo's storage services. Additionally, Qumulo nodes do not provide general-purpose shell access to end users, significantly limiting the attack surface. As of May 11, 2026, patched kernels from Ubuntu's upstream distribution are pending release. Qumulo is actively monitoring upstream availability and will incorporate the kernel patch into a future software release once it is available from our OS vendor. In the interim, customers may consult their Qumulo account team for guidance on interim mitigations.

Question 22

Is Qumulo affected by CVE-2026-24049, the Python wheel path traversal vulnerability?

Accepted Answer

Qumulo has assessed CVE-2026-24049, a path traversal vulnerability in the Python `wheel` package's `unpack` command that could allow file permission modification on the local system. This vulnerability has a CVSS v3.1 base score of 7.1 (High) and affects wheel versions 0.40.0 through 0.46.1. Qumulo rates this vulnerability as Informational for our platform. The vulnerable functionality, the `wheel unpack` command, is not used in Qumulo's software or operations. Exploitation requires a user to explicitly unpack a maliciously crafted wheel file; this action does not occur during normal Qumulo system operation. Standard Python package installation via `pip install` does not trigger the vulnerable code path. Additionally, Ubuntu has released a security update (USN-8221-1, April 2026) that addresses this vulnerability in the OS-level wheel package. No customer action is required.

Question 23

Is Qumulo affected by CVE-2025-38561, CVE-2025-39698, or CVE-2025-40019, the Linux kernel vulnerabilities reported in USN-8015-1?

Accepted Answer

Qumulo is aware of these Linux kernel vulnerabilities reported in Ubuntu Security Notice USN-8015-1. These vulnerabilities affect kernel subsystems and require local access to the system for exploitation. Qumulo rates these vulnerabilities as Low for our platform. Qumulo nodes do not provide general-purpose shell access to end users, which significantly limits the attack surface for kernel-level vulnerabilities that require local access. Qumulo regularly incorporates kernel security patches into platform image updates. Customers should plan to upgrade to the latest available Qumulo software version to receive these patches.

Question 24

Is Qumulo affected by CVE-2025-68615, the Net-SNMP snmptrapd buffer overflow vulnerability?

Accepted Answer

Qumulo is aware of CVE-2025-68615, a buffer overflow vulnerability in the Net-SNMP snmptrapd daemon that can be triggered by a specially crafted network packet. This vulnerability has a CVSS v3.1 base score of 9.8 (Critical). Despite the high NVD severity score, Qumulo rates this as Low risk because the affected component, snmptrapd (the SNMP trap receiver daemon), is not enabled in standard Qumulo deployments. Qumulo's SNMP functionality operates independently of the vulnerable trap-handling code path. Qumulo regularly incorporates security updates from its operating system vendor, and customers should ensure they are running the latest available Qumulo Core release.

Qumulo

About

Compliance & infrastructure

Documents

Subprocessors

Compliance leadership

Penetration test

Recent updates

This listing is partial

Frequently asked

Science peers that completed SOC 2

Elaborate

Truelearn LLC

Money Forward i Engineering

Merit Medicine