Pure Security

Security Documentation 

Our Security features are documented across various Product Documentation on our site. Here's a quick reference to our various Security sections.

FlashArray Security Documentation

• FlashArray Certifications and Compliance
  • Common Criteria
  • FIPS-140-2 Certification
  • FlashArrays and GDPR Compliance TB-171101
• FlashArray Security Reference
  • Pure Storage FlashArray Access Security TB-160202
  • The FlashArray Data Security Model TB-160201

Additional Reference:

• The Pure Storage Role in Malware Protection - TB-210402

FlashBlade Security Documentation

Customers should feel comfortable that their data is stored safely. Here is some documentation on FlashBlade Security.

• FlashBlade Certifications and Compliance
  • FlashBlade and GDPR Compliance TB-180202
• FlashBlade Safemode for Object Store

All blades that are returned to Pure undergo a stress test which erases and overwrites the data in every block within the NAND. Any blade that does not pass the stress test (broken, too worn, etc) is destroyed. We also offer a non-return option. This is more expensive to the customer as Pure does not get the blade returned. The support process for determining broken parts is the same except the customer would be responsible for the destruction of the non-returned part.

Additional Reference:

• Getting SSL to work with S3
• The Pure Storage Role in Malware Protection - TB-210402

Pure1 Security Documentation

• Pure1 Security Reference
  • Pure1 and GDPR Compliance - TB-210301
  • Pure1 Security: Technical Report TB-160501

Enterprise Security Documentation

• Environmental Health Security and Safety Policy
• How to Report a Security Incident

Security Advisories

"SpringShell" or "Spring4Shell" 

WAF rules mitigated against exploitation regarding the "Spring4Shell" Remote Code Execution Vulnerability (CVE-2022-22965).

Apache Log4j / Log4Shell

A self-service, online, non-disruptive patch to address the Log4j vulnerability (CVE-2021-44228) is now available.