Trust Center
Welcome to Safe Software's Trust Center. Our commitment to data privacy and security is embedded in every part of our business. Use this Trust Center to learn about our security posture and request access to our security documentation.
Partners can find dedicated resources in the Partner Resource Center.
McDonald's
T-Mobile USHere
TfL
Chevron
- Do you collect PII?
- What are Safe Software–owned websites, and what URLs need to be whitelisted if your environment is locked down?
- Is Safe Software/FME FIPS (U.S. Federal Information Processing Standards) compliant?
- Do you have a data retention policy?
- Does the FME platform provide an API?
Trust Center Updates
Recent PHP Vulnerabilities: FME Platform Not Impacted (CVE-2026-109618 & CVE-2026-109619)
Status: FME Platform is not affected
Summary
On October 21, 2026, the PHP Foundation disclosed two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619. They can allow unauthenticated remote code execution on servers running affected PHP versions. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Impact on Safe Software
- There is no impact to the FME product line, as none ship PHP interpreters.
- Safe Software has inventoried its internal and web-based services and systems for potential use of PHP. At the time of publishing, all identified systems have been addressed or confirmed not impacted.
- For more information, see our Knowledge Base article: PHP Vulnerabilities (CVE-2026-109618 & CVE-2026-109619): Is FME Impacted?
If a product is impacted, an actionable security advisory will be published with additional information.
AI Assist Security Whitepaper Updated for 2026.3
We've published an updated AI Assist Security Whitepaper for FME 2026.3.
The most significant change: AI Assist agent logic has been extracted from the AI Service and is now available as a client-side plugin that runs locally alongside FME Workbench. The whitepaper documents how the plugin is installed, how it's updated, and what the change means for your deployment and network controls.
Also new in this version:
- Token limits — how AI Assist usage is bounded and monitored per user
- EU AI Act compliance — how AI Assist supports transparency obligations, including the in-product disclosure and consent presented before users interact with AI-generated output
- Expanded security detail — new sections on data in transit, server-side architecture and network security, multi-tenancy and data isolation, encryption, and availability and resilience
Note: we've also added the AI Assist sub-processors table to our Privacy Policy.
SOC 2 Report Now Available
Our SOC 2 Type 2 report is now available through our Trust Center. Completion of the SOC 2 Type 2 audit demonstrates Safe Software's continued commitment to the security of our FME products and that of our overall security posture.
Our SOC 2 Type 1 report is now available through our Trust Center. Completion of the SOC 2 Type 1 audit demonstrates Safe’s continued commitment to the security of our FME products and that of our overall security posture.