Data protection regulations in general are designed to protect the personal data of individuals and impose obligations on organizations that collect, process, and store such personal data. These obligations apply to both our customers and Mimecast. We take our obligations under these data protection regulations (such as GDPR, CCPA, POPIA and PIPEDA) governing the services we provide seriously.
We are always reviewing our products and services and making enhancements to help support our customers’ data privacy compliance journey. We also commit ourselves to data protection through our Data Processing Addendum which is available to our customers.
Scroll down this page for information cards including:
- Certification and Attestation reports (security packs)
- Data Processing Addendum
- AI Development Pledge
- Processing details
- Technical and Organizational Measures
- Sub-processors
- Accessibility Statement
- Privacy Statement
We're here to help. Contact us at: certificationqueries@mimecast.com.
Trust Center Updates
Customer Advisory: Critical PHP Vulnerabilities (CVE-2026-109618 and CVE-2026-109619)
Summary
On 21 October 2026, the PHP project released emergency security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 (Critical) on CVSS v4 and could allow an unauthenticated attacker to execute code remotely with the privileges of the web worker. PHP has reported that working exploits were developed during its research, and it considers Apache mod_php installations the highest risk. Fixes are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
On 23 October 2026, the PHP project released details regarding a new vulnerability classified as CVE-2026-115560.
Our position
Mimecast has reviewed its product portfolio for exposure to these three vulnerabilities. Our review has confirmed that no Mimecast products or services are currently affected and no action is required from customers.
Product status
DMARC Analyzer 1.0: Mitigations applied
All other Mimecast products and services: Not affected