Trust Center
At Tempo, our strategy, systems, and people work seamlessly together to empower organizations. Our solutions help teams orchestrate the creation and delivery of work, enabling them to focus on their highest priorities and achieve optimal outcomes.
Trust is at the core of everything we do. Our commitment to data privacy and security is embedded in every part of our business. This Trust Center is designed to provide transparency into our security posture and to give you easy access to our compliance documentation, policies, and certifications.
Cisco
Airbus
Netflix
Slack
Oracle
Airbnb
Trust Center Updates
Tempo renews ISO/IEC 27001 and ISO/IEC 27701 certifications, now covering Loop and Workforce Intelligence
We’re pleased to share that Tempo has renewed its ISO/IEC 27001:2022 (information security) and ISO/IEC 27701:2019 (privacy information management) certifications for a new three-year cycle, following our September 2026 recertification audit.
What’s new in this cycle
-
Loop and Workforce Intelligence are now in scope, alongside Timesheets, Tempo Core, Time Tracker, Capacity Planner, Financial Manager, Portfolio Manager, Strategic Roadmaps and Idea Manager, Structure, Gantt Charts for Structure, Custom Charts for Jira and Confluence, and our BI Connectors for Jira (Power BI, Tableau, BigQuery, SQL and Data Studio).
-
The scope covers Tempo Software Inc and its affiliates for the development, operation, maintenance, and support of our cloud products.
The new certificates are publicly available in the Compliance section of this Trust Center.
eMudhra emSign CA Compromise (CVE-2026-91403): Limited Exposure, No Evidence of Exploitation
Status: Remediation in progress
Impact: Tempo services may be exposed through outbound connections only. We have found no evidence of exploitation.
Summary
On October 21, 2026, eight intermediate certificate authorities operated by eMudhra (emSign) were found to have compromised private keys (CVE-2026-91403). With those keys, an attacker could issue fraudulent TLS certificates for any domain. Major browsers and operating systems have blocked these certificates. Some software runtimes, including Java, Node.js and Go, do not receive these blocks automatically and need updates.
Tempo's assessment
- Inbound customer traffic to Tempo is not affected.
- Exposure is limited to outbound HTTPS connections that Tempo services make to external hosts.
- Exploitation would require an attacker to intercept network traffic between Tempo infrastructure and an external service, and to present a fraudulent certificate.
- We have found no evidence of exploitation.
Remediation status
Remediation is underway and not yet complete.
- In progress: Blocking the affected intermediate certificates across Tempo services as an interim measure.
- In progress: Verifying exposure and the applied fix across our environment.
- Planned: Moving to patched runtime versions as vendors make them available.
- Planned: Adding build checks to prevent regression.
Customer action required
None.
We will update this post as remediation progresses and when it is complete.
References
Critical PHP RCE (CVE-2026-109618, CVE-2026-109619): Tempo Not Affected
Impact: Tempo is not affected.
Summary
On October 21, 2026, the PHP project released security fixes for two critical vulnerabilities:
- CVE-2026-109618: remote code execution through memory corruption during request cleanup
- CVE-2026-109619: remote code execution through stale state reused across requests
Both vulnerabilities allow unauthenticated remote code execution on PHP installations that serve web requests.
Tempo's assessment
Tempo's Security team reviewed our environment and confirmed that PHP is not used in Tempo's production environment, product services or public-facing websites.
Customer action required
None.