Conveyor Inc. | Trust Center

On October 21, 2026, the PHP project released fixes for two critical remote code execution vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619).

Conveyor is not built using PHP, and we have confirmed that no PHP is present in our codebases or container images. No action is required from Conveyor customers.

We are monitoring the situation and will post an update to our Trust Center if there are any meaningful changes or updates.

This announcement is to let you know about two important security improvements to the Conveyor API. Adoption of the Conveyor API continues to increase, especially as we add additional features like updating the Knowledge Base or gathering raw data for reporting. Additionally, our recently launched MCP server can use API keys which introduces more considerations for properly scoping what you are granting access to.

API Key Visibility:
Previously, when adding an API Key to Conveyor, we would allow admin users to view the key after it was created. We have implemented a security enhancement to only show the key once at time of creation. After that, you will only be able to view the first right characters of a created key.

API Key Granular Permission:
Each API key you generate can now be associated with Read/Write/Delete permissions, as applicable, across the different possible API scopes. This enables you to enforce the principle of least privilege with API keys you generate, as well as ensure newly added APIs are not in scope by default.

To get the full benefit of these security improvements, we recommend you regenerate existing API keys. This will reduce the risk that a key was viewed by other admins after being created as well as allow you to rescope the key to have only the least privileges required for your specific use case.

Thanks for your continued feedback on our API offering.

We're updating our Privacy Statement with clarifications on how we manage our wider business operations and our relationship with customer administrators, including expanded disclosure on meeting recordings. Existing DPAs and commercial agreements are unchanged. You can review the updated policy here.

The Conveyor 2023 SOC 2 Type II is now available for your review. The audit was completed by Linford & Company LLP, covers a period from 1/1/2023 to 12/31/2023, and includes the trust services criteria for Security, Availability, and Confidentiality.

We're excited to enter 2024 with a new and improved status page! Check it out and subscribe to updates here: https://status.conveyor.com/.

Our 2022 SOC 2 Type II is now available for review in our Conveyor Room. The audit was completed by Linford & Company LLP, covers a period from 1/1/2022 to 12/31/2022, and includes the trust services criteria for Security, Availability, and Confidentiality.

As the news of the Okta security incident broke, we reviewed our Okta usage logs and user configurations. We see no indication that any of our data or user accounts were affected. Further, we are not in the 2.5% of customers that Okta has identified and contacted as being potentially affected by this incident. We will continue to closely monitor the situation and work with our key suppliers to understand the extent of any exposure.

Conveyor users on the Growth tier or higher can now manage user assignments to Conveyor entirely through Okta or other identity providers rather than needing to manage invitations in-app. You can additionally manage your users' roles via the SCIM Group functionality. We recommend enabling SCIM to make managing user access easier and less error-prone.

Our 2022 penetration test summary is now available for authorized users in our Conveyor Room.