Trust Center
BioRender recognizes the paramount importance of safeguarding the sensitive data our users trust us with and maintaining the privacy of our users. We strive to hold the highest standards of data privacy and security for the benefit of the global scientific community. As part of our commitment to data privacy and security, we have established this dedicated Trust Center, which serves as a comprehensive resource for those seeking to learn more about our security and privacy program. Within the Trust Center, individuals can request access to detailed reports and program specifics, demonstrating our dedication to transparency and accountability in all aspects of our operations.
Sanofi
The National Institutes of Health
AbbVie Inc.
CSL Behring
University of Toronto
Pfizer
Princeton University
Genentech
University of Cambridge
The University of Chicago
Subprocessors
- Do you provide choice to the user to opt out of AI use?
- Are you storing any passwords in plaintext?
- Are upgrades or system changes installed during off-peak hours or in a manner that does not impact the customer?
- Is your company subject to the institution's geographic region's laws and regulations?
- Do backups containing the institution's data ever leave the institution's data zone either physically or via network routing?
Trust Center Updates
PHP2Shell CVE-2026-109618 & CVE-2026-109619
On October 21, 2026, the PHP project disclosed two critical vulnerabilities in the PHP core runtime, tracked as CVE-2026-109618 and CVE-2026-109619 and known as “PHP2Shell.” Our security team began assessing exposure as soon as the disclosure was made.
Based on our assessment, BioRender’s production environment and the BioRender platform do not use PHP, and we have found no exposure to these vulnerabilities in systems we manage. We are also reviewing our third-party service providers and have asked those that may be affected to confirm their patch status. We continue to monitor our environment and will update this notice if our assessment changes.
If you have questions, please contact our security team @ security@biorender.com or through this Trust Center.
LiteLLM Malicious Version Compromise
On October 21, 2026, a malicious version (1.107.0) of LiteLLM, an open source gateway used to route requests to AI model providers, was published to PyPI and as official Docker images. The package contained malware that steals credentials. The affected releases were pulled the same day. This was a compromise of the project’s release process, not a vulnerability in the software, so no CVE has been assigned. It is tracked as malicious package advisory MAL-2026-2144.
BioRender uses LiteLLM. Our security team reviewed our environment, and we are running a version that was not affected by the compromise. We have found no evidence that our systems or customer data were compromised.
We continue to monitor the situation and will update this notice if our assessment changes. Questions can be directed to our security team through this Trust Center.
BioRender's Updated SOC 2 Type II Report
Our latest SOC 2 Type II report, audited by Sensiba LLP, is now available for download. This report reflects our continued commitment to maintaining strong security, availability, and confidentiality controls. Existing customers and prospects can request access through the Trust Centre.
CVE-2026-31431
BioRender (Science Suite Inc.) has assessed CVE-2026-31431, a Linux kernel local privilege escalation vulnerability recently disclosed with a CVSS score of 7.8.
BioRender has completed its assessment of this vulnerability across our infrastructure and confirmed that appropriate mitigations are in place. Remediation was carried out in accordance with our vulnerability management policy, which prioritizes high and critical severity findings for rapid response.
BioRender continuously monitors the threat landscape and maintains a proactive patching cadence to protect the confidentiality, integrity, and availability of customer data.