Security disclosure: notice and response

Schemata is committed to building secure software for the customers we serve. We are writing about a vulnerability in our platform that was brought to our attention by a security researcher, which we have since patched.

The vulnerability involved our API that could, under certain conditions, allow an authenticated user to access data belonging to other organizations on our platform. After we received actionable details about the vulnerability and confirmed the security researcher appeared to be legitimate, our team remediated the vulnerability the same day, and the researcher independently verified the fix before publishing their findings. We appreciate the security researcher bringing this to our attention and their contribution to the security of our platform.

Beyond the researcher's own testing, to date, we have not identified evidence that any third party exploited the vulnerability to access customer data.

Though this issue is now resolved, we are conducting a thorough audit of our systems and are committed to maintaining the highest standards of security on our platform.

After we learned of the vulnerability, we engaged with reputable cybersecurity consultants to assist in our response and improve our security posture. We are also in contact with governmental authorities about the vulnerability. We will be in contact with specific customers as appropriate.

Schemata is committed to further strengthening our security infrastructure. We are accelerating our efforts to obtain third-party security certifications, expanding our internal security team, and implementing third-party penetration testing as an ongoing practice. We are also conducting a comprehensive review of our platform.

To the security research community: we plan to build a vulnerability disclosure intake process that facilitates responsible reporting of security findings. We appreciate that the security researcher who contacted us recently helps keep platforms like ours safe and accountable.

For media inquiries, please contact press@schemata.com. For customer inquiries about this incident, please contact your account manager or security@schemata.com.

— James Brown, CEO, Schemata