Trust Center

Telecommunications operators manage some of the most sensitive, nationally critical data flows in any industry — and sector regulators are steadily increasing the obligations that flow down to their cloud service providers. At Confluent, we believe that meeting those obligations starts with transparency about how our platform is built and where responsibility sits between us and our customers.

We are pleased to announce the publication of our latest white paper: Trusted Cloud for Telecommunications: Navigating Global Regulatory Expectations.

This paper details how telecom operators can meet the security, sovereignty, and resilience expectations imposed by regulators across major jurisdictions — the United States, the European Union, the United Kingdom, Canada, Australia, India, and Singapore — and maps those obligations to Confluent's full data streaming portfolio.

Inside, you will find:
-Compliance enablement — A mapping of telecom regulatory obligations across jurisdictions to Confluent's security, sovereignty, and resilience capabilities.
-Shared responsibility clarity — A clear breakdown of what Confluent owns versus what the operator owns, helping shorten the back-and-forth during vendor security assessments.
-Full-portfolio coverage — How Confluent Cloud, Confluent Platform, Confluent Private Cloud, and WarpStream BYOC each address data-residency, sovereign-cloud, and air-gap requirements, giving telecom customers deployment flexibility without compromising compliance.
-Practical appendix — A jurisdiction-by-jurisdiction catalog of key regulatory frameworks (CPNI, NIS2, the UK TSA, SOCI, India's DPDP, Singapore's PDPA, and more) ready to use in customer conversations.

Where to Access
The white paper is now available on the Confluent Trust Center. We encourage you to share it with your security, compliance, and network architecture teams as you plan and scale critical workloads on Confluent.

Click Subscribe to be notified automatically of new reports, attestations, and security announcements. Thank you for your continued partnership.

At Confluent, your trust is the foundation of everything we build. We're pleased to share two new additions now available in the Confluent Trust Center: updated self-service due diligence templates, and a new government-backed security attestation.

2026 SIG Core and SIG Lite Templates Now Available

Security due diligence can be time-consuming, so we've published our completed 2026 SIG Lite and SIG Core templates — pre-answered questionnaires that let you skip manual back-and-forth. SIG Lite gives a quick, high-level view of our controls; SIG Core goes deeper for higher-risk or regulated evaluations.

This year's editions reflect current priorities, including new AI Governance risk frameworks, operational resilience and business continuity coverage, refreshed industry-standards alignment, and regulatory mapping updates including DORA.
Download our pre-completed templates directly from the Confluent Trust Center to expedite your due diligence requirements today.

BSI C5 Attestation Achieved

Confluent Cloud has achieved attestation against the BSI Cloud Computing Compliance Criteria Catalogue (C5), published by Germany's Federal Office for Information Security (BSI). C5 is a government-backed cloud security attestation framework, most recently updated as C5:2020, and built on standards like ISO/IEC 27001 and the Cloud Security Alliance's Cloud Controls Matrix, requiring transparency around data location, jurisdiction, and disclosure obligations to authorities.

For any organization evaluating our cloud security posture as part of procurement, vendor risk management, or regulatory readiness, the BSI C5 report provides an additional, independently audited data point confirming that Confluent's security controls are appropriately designed and operating effectively. This is particularly relevant for organizations in regulated industries — financial services, insurance, healthcare, and the public sector — that reference internationally recognized frameworks in their due diligence processes, and for customers operating in or serving Germany and the broader EU market, where C5 carries particular procurement weight.

The BSI C5 report is available now on the Trust Center.

Together, these updates reflect our ongoing commitment to making security and compliance transparent, accessible, and easy to act on — whether you need a quick self-service answer or independent, third-party assurance.

Click Subscribe to be notified as new reports, attestations, and announcements go live, and thank you for your continued partnership.

Trust is built through transparency — hence, we believe in giving our customers the visibility on what is on top of their mind with hyper relevant topics. We are excited to share that we have released two white papers that reflect that commitment, spanning from AI security to vendor risk monitoring.

What's New:

• Protecting Our Products, Services, and Customers at Scale in the Age of AI — How Confluent is adapting its security program to account for frontier AI as an emerging threat vector, including systems such as Anthropic's Mythos. Inside, you will find:

  • An overview of Project Trailblazer, Confluent's initiative to use frontier AI models to proactively test and harden our own systems ahead of adversarial use
  • Our approach to supply chain security investment, reflecting the priorities we hear most often from customer security teams
  • A grounded view of how Confluent's security architecture and operating model are evolving to keep pace with AI-driven threats

  We encourage your security and risk teams to use this paper as a reference point for how Confluent is approaching AI-related risk.

• Continuous Monitoring of Confluent: A Self-Service Guide for Vendor Risk Teams — A practical, step-by-step guide enabling customers' vendor risk and procurement teams to monitor Confluent's compliance posture independently — reducing questionnaire back-and-forth and shortening security review cycles.

As threats evolve and regulatory expectations rise, we remain committed to giving you the transparency, evidence, and architecture you need to move forward with confidence — not just to pass a review, but to build a lasting foundation of trust.

Click Subscribe to be notified automatically of new reports, attestations, and security announcements. Thank you for your continued partnership.

Klue, a third-party market-intelligence vendor, announced a security incident impacting their platform. Klue was used by Confluent sales and marketing teams. We want to provide Confluent customers with our current understanding of the scope of the incident.

Your data processed in Confluent products was not impacted. The data you entrust to our services, i.e., data processed through Confluent products, was not involved or impacted. There is no indication Confluent's products, platform, and infrastructure were affected by this incident.

What was affected. The Klue incident involved copying of Confluent business information stored in our customer relationship management (CRM) system — for example, business contact and internal go-to-market opportunity related information.

What we have done so far. After we were notified by Klue, we initiated an internal investigation and disconnected Klue integrations. The incident is limited to CRM data indicated above.

The security of our customers and their data remains our highest priority. We will continue to monitor this matter and provide further updates should additional information become relevant. Nothing is required from our customers currently.

For any questions, please contact Confluent Support.

We're pleased to add a new white paper to the Confluent Trust Center: Continuous Monitoring of Confluent: A Self-Service Guide for Vendor Risk Teams, authored by the Office of the CISO.

Traditional vendor due diligence relies on point-in-time questionnaires and audits that can leave Third-Party Risk Management (TPRM), security, and compliance teams looking backward. This white paper introduces a repeatable, self-service approach for continuously monitoring Confluent's security, availability, and compliance posture, so your teams can quickly answer the question, "Has anything changed that might affect our risk?"

The guide is organized around four practical monitoring dimensions, each grounded in customer-visible signals you can subscribe to and act on today:

• Dimension 1 — Service Health and Security Advisories: the Confluent Cloud Status Page and Support Portal security advisories.
• Dimension 2 — Vendor and Technology Stack: the Subprocessor List and SOC 2 report to understand Confluent's third-party footprint.
• Dimension 3 — Trust and Compliance Evidence: Trust Center attestations (SOC 2, ISO, PCI), security white papers, and security announcements.
• Dimension 4 — Direct Vendor Engagement: a structured, last-resort path for the rare questions that self-service signals don't fully resolve.

The paper also includes a one-page continuous-monitoring checklist your TPRM program can adopt immediately, and the same model can be reused across your broader vendor portfolio.

Read the white paper now in the Confluent Trust Center.

Click Subscribe to be notified automatically of new reports, attestations, and security announcements.