Tray.ai | Trust Center

On 21 October, Node.js released security fixes, including one for a Brotli decompression bug (CVE-2026-111497, aka "node2shell"), and removed the compromised eMudhra (emSign) certificate authorities from its trusted roots.

Tray has been working on these issues since they were first disclosed, including working with our cloud infrastructure provider, AWS, as updated runtimes became available, and our security team is monitoring the situation closely.

Am I affected?

If we believe you are impacted, we will contact you directly and tell you what to do. If you haven't heard from us, you don't need to take any action.

Our response

• On the day of disclosure, we assessed every part of the Tray platform that uses Node.js or relies on the affected certificate authorities.
• We have rolled out updates to Tray-hosted services through our standard change-management process, prioritising the highest-risk areas.
• We verify each fix after it is deployed, to confirm the vulnerable component has been replaced.
• We are monitoring closely for activity related to these vulnerabilities.

Tray's own certificates are not affected

None of Tray's public-facing certificates are issued by eMudhra or emSign. Browsers are removing trust in these authorities, and that will not affect access to Tray services.

General guidance

As general good practice, if you use Tray developer tooling locally or in your own infrastructure, such as the Tray CDK CLI for building custom connectors or the Helix CLI, keep it on a supported Node.js release that includes the October 2026 security updates (22.23.4, 24.22.1, 26.12.1 or later).

Tray.ai is not affected by the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 ("php2shell"). No action is required from customers.

We're pleased to announce that we have successfully completed our SOC 1 Type 2 examination, conducted by Schellman & Company, LLC.

This independent audit validates that our controls relevant to user entities' internal control over financial reporting are suitably designed and operating effectively. The examination covered the period from August 1, 2024, to July 31, 2025, and demonstrates our commitment to maintaining robust controls that support our customers' financial reporting requirements.

What This Means for You

SOC 1 Type 2 compliance provides assurance that:

• Our control environment meets rigorous industry standards for financial reporting controls
• Independent auditors have verified both the design and operational effectiveness of our controls over a 12-month period
• Your organisation can rely on our platform as part of your own internal control over financial reporting (ICFR) framework

This achievement complements our existing SOC 2 Type 2 certification, reinforcing our dedication to security, compliance, and operational excellence across all aspects of our service delivery.

CVE-2024-3094: We can confirm that Tray is not affected by this vulnerability. Tray uses Amazon Linux which AWS has confirmed that neither their customer nor infrastructure is impacted https://aws.amazon.com/security/security-bulletins/AWS-2024-002/

We can confirm that Tray does not use this software and is therefore not affected by this vulnerability.