Trust Center
At AvidXchange, privacy and security are embedded in everything we do. We earn trust by treating customer data like we would our data. We layer in security across every area of our business, ensuring that private customer data stays private. Explore this portal to learn about our security practices and request access to official security documentation.
Not a customer? Book your demo now! Request a Demo
Brazos Valley Schools Credit Union
Colliers International
Hampton Golf
San Antonio Zoo
SmartBank
Westport Construction
AvidAscend Customers
AvidAscend Customers, please request access for additional documentation.
- What is the operational status of AvidXchange products?
Trust Center Updates
Critical PHP Vulnerabilities (PHP2Shell)
As part of our ongoing response to the recently disclosed critical PHP vulnerabilities (PHP2Shell), AvidXchange has conducted a thorough investigation following our Vulnerability Management Standard and Incident Response Plan. Our Security Team concluded that there is no impact to any production systems or evidence to indicate exploitation. Therefore, there is no impact to our operations or suspected impact to our customers.
Citrix NetScaler Security Bulletin (CVE-2026-88771 through CVE-2026-88778)
AvidXchange is aware of the recently disclosed Citrix NetScaler ADC and Citrix NetScaler Gateway vulnerabilities identified as CVE-2026-88771 through CVE-2026-88778.
AvidXchange promptly assessed its environment and completed patch remediation activities for all affected systems. Our review confirmed that the necessary security updates and mitigations have been successfully applied. None of AvidXchange's NetScaler products in use are internet facing.
At this time, AvidXchange has found no evidence of exploitation, unauthorized access, service disruption, or impact to customer data, AvidXchange operations, or third-party partners related to these vulnerabilities.
The security of our customers' data and services remains a top priority. We continue to actively monitor the situation and maintain our standard vulnerability management and security monitoring processes to help ensure ongoing protection of our environment.
Bridge Letters Now Available on AvidXchange’s Trust Center
We’re pleased to announce that our latest bridge letters are now available on the AvidXchange Trust Center. These letters provide assurance during the period between our most recent SOC audit reports and the next scheduled audit, reinforcing our commitment to transparency and data security.
You can request the bridge letters under the Featured Documents section of the AvidXchange Trust Center: trust.avidxchange.com.
2025 SOC Reports Available
We are pleased to announce that our latest SOC 1 Type II and SOC 2 Type II audit reports, conducted by Forvis Mazars LLP, are now available on AvidXchange’s Trust Center. This update reflects our continued commitment to safeguarding your data and ensuring compliance with industry standards and best practices.
The reports can be requested under the Featured Documents section of AvidXchange’s Trust Center: trust.avidxchange.com
F5 Device Vulnerability
AvidXchange has reviewed and investigated the potential impact of the critical vulnerabilities in F5 devices (https://www.cisa.gov/news-events/news/cisa-issues-emergency-directive-address-critical-vulnerabilit…). AvidXchange is not affected and does not leverage F5 devices or software.
AvidXchange monitors security information resources for vulnerability announcements, patch and non-patch remediation change, security events and incidents, and emerging threats that correspond to the software and hardware within AvidXchange’s system inventory. Patches are regularly applied per our Vulnerability Management Standard, which includes applying patches monthly at minimum. Advanced Malware Protection controls are deployed to all corporate-issued endpoints. These controls receive updates in real-time in alignment with best practices.