SolarWinds Trust Center
The latest tips and assets developed for you
Secure by Design – and secure by default
SolarWinds follows a defined software development methodology designed to increase the resiliency and security of our products. This process follows U.S. federal guidelines for secure software development as described in the National Institute of Standards & Technology Secure Software Development Framework (SSDF). Additionally, we follow guidelines described in the Enduring Security Framework (ESF).
- We have formed a cross-functional team of experts to review these guidelines and adjust our processes as required
- We conducted a thorough gap analysis of our development process against the controls recommended in the SSDF
- We identified which controls we met or did not meet
- We then adjusted our processes to meet the unmet controls, or developed alternate secure processes
Technical & Organizational Measures
We strive to implement and maintain appropriate administrative, physical, and technical safeguards, security processes, procedures, and standards designed to protect the confidentiality and security of our customer data.
Vendor Data Protection Requirements
Third-party vendors are used to provide SolarWinds with various goods and services to help facilitate its business. Before entering any third-party relationships, we take deliberate steps to assess the risk related to the vendor relationship. We take care to understand the compliance, reputational, strategic, operational, and transactional risks relating to a particular vendor before entering into a contractual relationship.
Security Testing Program
SolarWinds conducts regular external penetration tests using independent, accredited third-party firms. We share executive summaries of those assessments to provide transparency into our testing approach and remediation practices.
To protect all customers, we do not disclose specific vulnerability findings or detailed exploit information.
Sharing such information—especially outside a tightly controlled, need-to-know context—could introduce risk to our customers by making potential attack vectors more discoverable.
We are happy to provide further assurance by:
- Confirming the scope, cadence, and methodology of our third-party testing
- Demonstrating our vulnerability management and remediation processes
- Sharing relevant compliance reports (e.g., SOC 2, ISO 27001) upon request
SolarWinds follows a defined software development methodology designed to increase the resiliency and security of our products. This process follows U.S. federal guidelines for secure software development as described in the National Institute of Standards & Technology Secure Software Development Framework (SSDF). Additionally, we follow guidelines described in the Enduring Security Framework (ESF).
- We have formed a cross-functional team of experts to review these guidelines and adjust our processes as required
- We conducted a thorough gap analysis of our development process against the controls recommended in the SSDF
- We identified which controls we met or did not meet
- We then adjusted our processes to meet the unmet controls, or developed alternate secure processes
Technical & Organizational Measures
We strive to implement and maintain appropriate administrative, physical, and technical safeguards, security processes, procedures, and standards designed to protect the confidentiality and security of our customer data.
Vendor Data Protection Requirements
Third-party vendors are used to provide SolarWinds with various goods and services to help facilitate its business. Before entering any third-party relationships, we take deliberate steps to assess the risk related to the vendor relationship. We take care to understand the compliance, reputational, strategic, operational, and transactional risks relating to a particular vendor before entering into a contractual relationship.
Security Testing Program
SolarWinds conducts regular external penetration tests using independent, accredited third-party firms. We share executive summaries of those assessments to provide transparency into our testing approach and remediation practices.
To protect all customers, we do not disclose specific vulnerability findings or detailed exploit information.
Sharing such information—especially outside a tightly controlled, need-to-know context—could introduce risk to our customers by making potential attack vectors more discoverable.
We are happy to provide further assurance by:
- Confirming the scope, cadence, and methodology of our third-party testing
- Demonstrating our vulnerability management and remediation processes
- Sharing relevant compliance reports (e.g., SOC 2, ISO 27001) upon request
SolarWinds AI
AI By Design
SolarWinds development and operation of artificial intelligence capabilities are governed by AI by Design, an extension of our Secure by Design methodology. AI by Design establishes four principles:
- Privacy and security
- Accountability and fairness
- Transparency and trust
- Simplicity and accessibility
SolarWinds applies these principles through data minimization, purpose limitation, role- and permission-based access controls, and other applicable safeguards. Customer data submitted to SolarWinds AI features is not used to train or fine-tune underlying third-party foundation models. AI-related data and processing are subject to applicable SolarWinds security, privacy, retention, and compliance requirements.
Assistive AI Functionality and Customer Controls
SolarWinds AI is designed to provide assistive functionality and is not an unrestricted autonomous administrator. AI-generated content, recommendations, and outputs may be inaccurate, incomplete, or unsuitable for a particular purpose. Customers are responsible for reviewing and validating such outputs before relying on them or acting upon them. Any action-taking functionality, where available, is subject to product configuration and constrained by applicable tenant, user, permission, connector, tool, policy, and autonomy controls. Read-only analysis may be performed without modifying a customer environment. Where a workflow permits actions, execution may require human review, explicit approval, or customer-configured automation in accordance with applicable risk controls. SolarWinds may record interactions, recommendations, approvals, and actions as necessary or appropriate for transparency, security, governance, troubleshooting, and auditability. Customers may turn off AI capabilities where that control is available in the applicable product.
AI By Design
SolarWinds development and operation of artificial intelligence capabilities are governed by AI by Design, an extension of our Secure by Design methodology. AI by Design establishes four principles:
- Privacy and security
- Accountability and fairness
- Transparency and trust
- Simplicity and accessibility
SolarWinds applies these principles through data minimization, purpose limitation, role- and permission-based access controls, and other applicable safeguards. Customer data submitted to SolarWinds AI features is not used to train or fine-tune underlying third-party foundation models. AI-related data and processing are subject to applicable SolarWinds security, privacy, retention, and compliance requirements.
Assistive AI Functionality and Customer Controls
SolarWinds AI is designed to provide assistive functionality and is not an unrestricted autonomous administrator. AI-generated content, recommendations, and outputs may be inaccurate, incomplete, or unsuitable for a particular purpose. Customers are responsible for reviewing and validating such outputs before relying on them or acting upon them. Any action-taking functionality, where available, is subject to product configuration and constrained by applicable tenant, user, permission, connector, tool, policy, and autonomy controls. Read-only analysis may be performed without modifying a customer environment. Where a workflow permits actions, execution may require human review, explicit approval, or customer-configured automation in accordance with applicable risk controls. SolarWinds may record interactions, recommendations, approvals, and actions as necessary or appropriate for transparency, security, governance, troubleshooting, and auditability. Customers may turn off AI capabilities where that control is available in the applicable product.
Case Study
Zenith Pensions relies on SolarWinds for simple, powerful, secure solutions
Follow Zenith's story: Vulnerable to phishing attacks after emailing sensitive info. Witness their journey to a secure file transfer solution.
We hold ourselves to high standards of excellence
Secure file transfer and file sharing from an intuitive, central console
Security Leaders
Becky Melton
Becky Melton serves as General Counsel and Group Vice President of Corporate Legal at SolarWinds, where she provides senior legal leadership, oversees enterprise-wide legal strategy, and supports the company’s global growth initiatives. She brings extensive expertise in corporate governance, commercial transactions, employment law, and regulatory compliance.
David Ramsey
David Ramsey is our Group Vice President and Chief Information Officer at SolarWinds, where he leads the company’s global IT strategy and operations. With 28 years of CIO experience across multiple companies, he brings deep cross‑industry expertise in modernizing technology and aligning IT with business outcomes. At SolarWinds, he plays a key role in the company’s transformation, applying lessons from prior CIO roles and advisory work.
Justin Henkel
Justin Henkel is the Chief Information Security Officer at SolarWinds and a retired U.S. Air Force Lieutenant Colonel. With a background in military intelligence and enterprise cybersecurity, he leads global security strategy, product security, and cyber resilience initiatives. Justin is passionate about Secure by Design, threat intelligence, and building high-performing security teams that enable business growth and customer trust.
