Trust and Security Portal
Overview
Palantir is a software company that builds the world's leading software for data-driven operations and decision-making. For more than a decade, we’ve worked with customers in the most secure and highly-regulated industries and built software for their most sensitive data. Today, security remains the cornerstone of our product development, company culture, and internal operations.
Palantir cares deeply about the security outcomes of our customers, and we’re committed to transparency about our security practices and program. We stand resolute in continuously improving our security, data protection, and privacy controls to give you the most effective means of protecting your data possible.
Compliance
Documents
Product Security
Reports
Self-Assessments
Data Security
Application Security
Legal
Data Privacy and Compliance
Access Control
Production Infrastructure
Endpoint Security
Network Security
Corporate Security
Policies
Security Grades
Trust Center Updates
Many third-party organizations leverage "third-party risk assessment" platforms as part of their security due diligence efforts.
Unfortunately, the Palantir Information Security Team has increasingly observed that many of the platforms in this space are unreliable and include flawed "results" or "findings" which are irrelevant and erroneous. These platforms regularly misattribute information between unrelated organizations, employ questionable techniques resulting in data collection and completeness problems, and fundamentally do not provide valuable information about Palantir's infrastructure or security risk.
At the date of this publication, historic substantive, true-positive findings observed in these platforms has been de minimus. Individually responding to erroneous findings across an increasing tapestry of vendors in this space is an onerous and expensive task which ultimately detracts from meaningful cybersecurity work. As such, it is the policy of the Palantir information security team not to respond to inquiries or "findings" generated by such vendors or platforms.
We believe this policy allows us to best direct our cybersecurity resources towards efforts that maximize the security for Palantir, and for our customers. This ultimately allows us to meet the highest bar for security, data protection, privacy, and compliance, to which we are committed. In furtherance of this commitment, through our Safebase portal, we have published detailed security documentation, including reliable information reflecting risk and posture management, penetration and security testing, our accreditations, security controls, and other relevant, and detailed, security and technical information in order to inform meaningful risk assessments by our customers and prospective customers.
We remain confident that these materials demonstrate how Palantir's infrastructure and operations meet the highest security standards.
Security Bulletin
A security bulletin has been publicly disclosed for our software.
PALSEC-2023-01
An information disclosure issue was discovered in db-controller that leaked database credentials when installed in a Kubernetes-based service orchestration environment.
More Information
Full details of this security bulletin can be found in our GitHub repository.
Security Bulletin
A security bulletin has been publicly disclosed for our software.
PALSEC-2022-07
An information disclosure issue was discovered in Rubixbeat, a logging component of Palantir Apollo, when receiving logs originating from the Foundry Code-Workbooks service.
More Information
Full details of this security bulletin can be found in our GitHub repository.
Security Bulletin
A security bulletin has been publicly disclosed for our software.
PALSEC-2022-05
The delivery-metadata service in Palantir Apollo was found to permit API endpoints that did not adequately require authentication to query, potentially granting read access to metadata such as deployed software version numbers to unintended recipients. The subsequent investigation uncovered insufficient authentication controls in the team-ownership service as well, which is responsible for metadata pertaining to package installations. These vulnerabilities are resolved in apollo-deployment-state version 4.714.0, delivery-metadata version 2.565.0, and team-ownership version 0.171.0, respectively. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest version of all relevant Apollo services.
More Information
Full details of this security bulletin can be found in our GitHub repository.
Security Bulletin
A security bulletin has been publicly disclosed for our software.
PALSEC-2022-04
The Blobster service was found to have a cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to Foundry to launch attacks against other users. This vulnerability is resolved in Blobster 3.228.0, which has been automatically deployed to all Apollo-managed Foundry instances. As part of maintaining good security hygiene, it is highly recommended that all customers upgrade to the latest version of Blobster.
More Information
Full details of this security bulletin can be found in our GitHub repository.
Security Bulletin
A security bulletin has been publicly disclosed for our software.
PALSEC-2022-03
The Foundry Magritte plugin osisoft-pi-web-connector was found to be logging in a manner that captured authentication requests. This vulnerability is resolved in osisoft-pi-web-connector version 0.44.0. Magritte sources which leverage this plugin using HTTP Basic Authentication should change their OSISoft PI System account credentials.
More Information
Full details of this security bulletin can be found in our GitHub repository.
Security Response
CVE-2022-3786 and CVE-2022-3602:
Background
On October 25th, the OpenSSL maintainers published an announcement to the community of a forthcoming release of version 3.0.7 which contained a patch for a CRITICAL vulnerability set to be released on November 1. Upon receiving the notification, the Palantir CIRT (Computer Incident Response Team) opened an investigation to determine the overall exposure to Palantir platforms and infrastructure. Subsequent notices from the OpenSSL maintainers indicated that only the 3.0.x branch contained the CRITICAL fix and so, in conjunction with our product development teams, we began to investigate and understand the usage of OpenSSL 3.0.x across our organization. By Friday October 28th we concluded our assessment and stood by for the November 1 release.
Yesterday, OpenSSL 3.0.7 was released which resolved two HIGH CVEs: CVE-2022-3786 and CVE-2022-3602. After the initial announcement on October 25th, the OpenSSL maintainers conducted further analysis of the issues and determined they were not as exploitable as initially thought. Regardless, the Palantir InfoSec Team treats all software issues of this nature with the utmost importance, regardless of the surrounding circumstances.
Palantir is not affected
Palantir is not affected by the OpenSSL vulnerabilities in CVE-2022-3786 and CVE-2022-3602:
After a comprehensive search for usage of the offending libraries we have no reliance on and have found no evidence of OpenSSL 3.0.x in our hosted infrastructure and products. There is no action required for any of our customers.
If you think you may have discovered a vulnerability, please send us a note.