Is Qumulo penetration tested?

Qumulo hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Can I get Qumulo's SOC 2 report?

Qumulo's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Security isn't a single yes/no, but Qumulo is SOC 2 Type II compliant and holds SOC 2 Type II, GDPR, HIPAA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Does Qumulo have a bug bounty or vulnerability disclosure program?

Qumulo hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@qumulo.com or via a /security page (Qumulo lists a security contact).

Who are Qumulo's subprocessors?

Qumulo lists 14 subprocessors on its trust center, including Microsoft Azure, Datadog, Google Workspace, Okta, PagerDuty. Buyers use this for fourth-party risk review.

Where is Qumulo's trust center or security page?

Qumulo's trust center is at https://trust.qumulo.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Is this your company? Buyers are checking Qumulo here. Claim qumulo.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.

Claim free

Qumulo

qumulo.com· 51–200 employees· Security contact

Security overview Compliance Penetration test

Trust level

Listed

Unverified

Listed

Domain

Report

Live

Sourced from public information. Not yet verified by the company.

Qumulo is SOC 2 Type II compliant. Qumulo also holds GDPR, and HIPAA.

Request report access Claim this profile

Framework

Auditor

Last report

Renewal

View official trust center ↗

About

Qumulo is dedicated to helping our customers understand how we secure customer information, protect individual privacy, and comply with security and privacy laws and standards. If you have any questions that are not answered on this page, please contact [security@qumulo.com](mailto:security@qumulo.com). You can visit the main Qumulo website at [www.qumulo.com](https://qumulo.com/).

Compliance & infrastructure

SOC 2 Type II GDPR HIPAA

Hosting

Azure

Data handled

Customer personally identifiable informationEmployee personally identifiable informationCredit card informationPersonal health information

Documents

Qumulo-Nexus-2025-Type 2 SOC 2-Final Report.pdfRequest

QUESTIONNAIRES

HECVAT for Qumulo Core and Cloud Native QumuloRequest

Subprocessors

M
Microsoft Azure · Cloud provider
United States
D
Datadog · Cloud monitoring
United States
G
Google Workspace · Document management
United States
O
Okta · Identity provider
United States
P
PagerDuty · Cloud monitoring
United States
S
Salesforce · Sales
United States
S
Slack · Collaboration
United States
W
Workato Inc · Other
United States
Z
Zoom · Collaboration
United States
M
MongoDB Atlas · Data storage and processing
United States
S
SendGrid · Marketing
Denver, Colorado
S
Statsig · Product
Bellevue, Washington

Show all 14 subprocessors

M
M3ter · Finance and payments
UK
E
Elastio · Security
Reston, Virginia

Compliance leadership

The person who leads Qumulo's SOC 2 isn't listed yet. Claim this profile to add it.

Penetration test

Unknown. Qumulo's penetration test vendor isn't listed yet.

Claim this profile to add it.

Recent updates

Updates to our Subprocessor ListMay 2026

Effective immediately (May 2026) we have updated the list of sub-processors used to process personal data in connection with Azure Native Qumulo (ANQ) and Nexus. These sub-processors will assist us in enhancing your overall experience. We have carefully selected these sub-processors to meet the highest privacy and security standards. The new subprocessors are: SendGrid Statsig Elastio M3ter More details about our full list of subprocessors are available here: https://trust.qumulo.com/subprocessors If you have any questions about these changes, do not hesitate to contact us at [dataprivacyoffice@qumulo.com](mailto:dataprivacyoffice@qumulo.com).

New SOC 2 Reports available!May 2026

Qumulo's SOC 2 Type 2 Reports for the period of November 2024 through November 2025 are now available. Contact security@qumulo.com with any questions. View the Nexus SOC 2 Type 2 Report here. View the Enterprise SOC 2 Type 2 Report here.

Report available validating ransomware prevention with Qumulo and anti-virus!Aug 2024

A new independent third party report, commissioned by Superna, shows that anti-virus deployed in a Qumulo environment will instantly stop multiple types of ransomware attacks! Get the resource here: Report on Superna and Qumulo

Notice of Material Change to Privacy NoticeJul 2024

We have updated our Privacy Notice, effective from July 1, 2024, to clarify how we collect, use, disclose and otherwise process personal data in connection with our Services. If you have any questions about these changes, do not hesitate to contact us at [dataprivacyoffice@qumulo.com](mailto:dataprivacyoffice@qumulo.com) To acquire prior versions of this Privacy Notice, contact [dataprivacyoffice@qumulo.com](mailto:dataprivacyoffice@qumulo.com).

New SOC 2 Type II report available!Jun 2024

Qumulo is proud to announce that we have once again completed a SOC 2 Type II assessment with independent, certified audit agency, A-Lign. This report, which covers the period from April 2023 through March 2024, is available by request at trust.qumulo.com/resources to all current customers and prospects who have signed confidentiality agreements with Qumulo. Please contact security@qumulo.com with any questions!

This listing is partial

7/11 details · 64%

SOC2C shows the verified essentials. 4 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.

Auditorraises trust
Add the CPA firm that issued your SOC 2 so buyers can verify who signed it.
Report dateraises trust
Add your most recent report period so buyers see how current your SOC 2 is.
Renewal date
Add your renewal window so buyers know your coverage is active.
Security controls
Confirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.

Claim free to control your listing

Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.

Frequently asked

Is Qumulo SOC 2 compliant?

Qumulo is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Is Qumulo GDPR compliant?

According to Qumulo's public trust center, Qumulo is GDPR compliant. On SOC2C this listing is Listed.

Is Qumulo HIPAA compliant?

According to Qumulo's public trust center, Qumulo is HIPAA compliant. On SOC2C this listing is Listed.

Is Qumulo SOC 2 Type I or Type II?

Qumulo is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Can I use Qumulo's SOC 2 for a vendor risk assessment?

Yes. Qumulo's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Show 7 more questions

Answers published by Qumulo

Reproduced from Qumulo's own trust center. These are the company's statements about its security practices — SOC2C has not tested or verified them, and they may have changed since we last read the page. Check the source ↗

Do you encrypt data at rest?

Yes. All file data is encrypted at rest by default in Qumulo version 3.1.5 and higher.

Do you support Single Sign-On (SSO)?

Yes. SSO and MFA is available on Qumulo Core 5.2.5.1 and higher.

Do you have access to the data I store on my Qumulo instance?

No, Qumulo does not have access to your file data. If you enable Cloud Based Monitoring for your cluster, Qumulo will collect metrics about the health of your cluster. If you enable Remote Support, Qumulo support engineers will have access to your cluster and the logs necessary to troubleshoot and resolve issues, but not your file data.

How do you handle secure data deletion?

Qumulo has media disposal procedures and policies, and the lifecycle management company we utilize provides certificates of destruction for required resources. Disk retention is available for customers with on-prem deployments who wish to retain and destroy old disks according to their own data deletion policies and practices. For cloud offerings in AWS and GCP, please review their data destruction statements. For the Azure Native Qumulo managed service, the Azure data-destruction statement is available here.

How do you back up my data?

Qumulo does not back up and restore customer data. Customers can manage backup and recovery of their Qumulo instance according to your enterprise BC/DR policy. For customers who require support for immutable point-in-time data, Qumulo ships with Snapshot Locking and Replication functionality that can be set to your specifications based on your data handling policies. These features ship as part of your standard Qumulo software subscription at no extra cost to you, and support many use cases, such as litigation holds, business continuity and disaster recovery, and ransomware protection.

How can I get a full SOC2 Report?

Qumulo's SOC 2 report is available via the Resources section on this Trust Center. You may be asked to sign an NDA prior to accessing documentation containing confidential information. Please contact [security@qumulo.com](mailto:security@qumulo.com) with any questions or difficulty accessing the resources you need.

Has Qumulo assessed the "SMB Signing not required" finding reported by my vulnerability scanner?

Some vulnerability scanners report that SMB signing is not enforced by default on Qumulo storage clusters. This is a configuration setting, not a software vulnerability. Qumulo's SMB implementation fully supports both SMB signing and SMB encryption. Whether SMB signing is required is controlled by cluster policy settings and can also be enforced through Active Directory Group Policy. Customers whose security policies require SMB signing can enable it through Qumulo's cluster SMB configuration or by enforcing it via Group Policy on domain-joined clients. For detailed guidance, please contact your Qumulo account team. No software update is required to address this finding.

Is Qumulo affected by CVE-2026-31431 (Copy Fail)?

CVE-2026-31431 is a vulnerability in the Linux kernel's `algif_aead` cryptographic subsystem. The vulnerability, publicly known as "Copy Fail," could allow a local, authenticated attacker to impact the confidentiality, integrity, and availability of an affected system. It has a CVSS v3.1 base score of _7.8 (High)._ Qumulo assessed this vulnerability and determined that, while the affected kernel module was present in the underlying operating system, Qumulo's architecture limits the practical exploitability of this issue. The attack requires local access and an authenticated user with existing privileges on the node, conditions that are not typical in standard Qumulo deployments. Resolution: Qumulo Core version 7.8.4.3 mitigates this vulnerability by disabling the `algif_aead` kernel module. Customers running Qumulo Core 7.8.4.3 or later are not affected. Recommended Action: Customers should upgrade to Qumulo Core 7.8.4.3 or later. If you have questions or need assistance with the upgrade, please contact Qumulo Support.

Is Qumulo affected by CVE-2026-43284 ("Dirty Frag"), the Linux kernel privilege escalation vulnerability?

Qumulo is aware of CVE-2026-43284, a Linux kernel vulnerability in the IPsec ESP and RxRPC subsystems that can allow local privilege escalation. This vulnerability has a CVSS v3.1 base score of 8.8 (High) and requires an attacker to already have local shell access to the system. Qumulo rates this vulnerability as Low risk for our platform. The affected kernel subsystems (IPsec ESP and RxRPC) are not used by Qumulo's storage services. Additionally, Qumulo nodes do not provide general-purpose shell access to end users, significantly limiting the attack surface. As of May 11, 2026, patched kernels from Ubuntu's upstream distribution are pending release. Qumulo is actively monitoring upstream availability and will incorporate the kernel patch into a future software release once it is available from our OS vendor. In the interim, customers may consult their Qumulo account team for guidance on interim mitigations.

Is Qumulo affected by CVE-2026-24049, the Python wheel path traversal vulnerability?

Qumulo has assessed CVE-2026-24049, a path traversal vulnerability in the Python `wheel` package's `unpack` command that could allow file permission modification on the local system. This vulnerability has a CVSS v3.1 base score of 7.1 (High) and affects wheel versions 0.40.0 through 0.46.1. Qumulo rates this vulnerability as Informational for our platform. The vulnerable functionality, the `wheel unpack` command, is not used in Qumulo's software or operations. Exploitation requires a user to explicitly unpack a maliciously crafted wheel file; this action does not occur during normal Qumulo system operation. Standard Python package installation via `pip install` does not trigger the vulnerable code path. Additionally, Ubuntu has released a security update (USN-8221-1, April 2026) that addresses this vulnerability in the OS-level wheel package. No customer action is required.

Is Qumulo affected by CVE-2025-38561, CVE-2025-39698, or CVE-2025-40019, the Linux kernel vulnerabilities reported in USN-8015-1?

Qumulo is aware of these Linux kernel vulnerabilities reported in Ubuntu Security Notice USN-8015-1. These vulnerabilities affect kernel subsystems and require local access to the system for exploitation. Qumulo rates these vulnerabilities as Low for our platform. Qumulo nodes do not provide general-purpose shell access to end users, which significantly limits the attack surface for kernel-level vulnerabilities that require local access. Qumulo regularly incorporates kernel security patches into platform image updates. Customers should plan to upgrade to the latest available Qumulo software version to receive these patches.

Is Qumulo affected by CVE-2025-68615, the Net-SNMP snmptrapd buffer overflow vulnerability?

Qumulo is aware of CVE-2025-68615, a buffer overflow vulnerability in the Net-SNMP snmptrapd daemon that can be triggered by a specially crafted network packet. This vulnerability has a CVSS v3.1 base score of 9.8 (Critical). Despite the high NVD severity score, Qumulo rates this as Low risk because the affected component, snmptrapd (the SNMP trap receiver daemon), is not enabled in standard Qumulo deployments. Qumulo's SNMP functionality operates independently of the vulnerable trap-handling code path. Qumulo regularly incorporates security updates from its operating system vendor, and customers should ensure they are running the latest available Qumulo Core release.

Show 7 more questions

Science peers that completed SOC 2

Compare vs Truelearn LLC Compare vs Elaborate Compare vs Money Forward i Engineering