Captain Compliance Outage History
Captain Compliance is up right nowPingoru has recorded 4 incidents for Captain Compliance: 4 in the last 12 months and 3 in the last 90 days.
Incidents, newest first
Minor October 14, 2026 Some services are degraded 57m Consent on your website (Cookie banner and blocking)
Started Oct 14, 2026, 07:41 PM UTC· resolved Oct 14, 2026, 08:38 PM UTC
- investigating Oct 14, 2026, 07:41 PM UTC
Cookie banner and blocking are having some degraded services in EU region (no US regions are effected), non effecting to customer view
- resolved Oct 14, 2026, 08:38 PM UTC
Cookie banner services in EU region are now no longer degraded - the issue stemmed from a downstream provider latency and cache build up. A fix has been implemented and services are restored back to normal.
Major October 4, 2026 Data subject request forms is down 11m Consent on your website (Data subject request forms)
Started Oct 04, 2026, 06:24 PM UTC· resolved Oct 04, 2026, 06:35 PM UTC
- investigating Oct 04, 2026, 06:24 PM UTC
Data subject request forms went down.
- resolved Oct 04, 2026, 06:35 PM UTC
Data subject request forms recovered.
Major September 23, 2026 Services is down 11m Customer dashboard (Platform API)
Started Sep 23, 2026, 04:49 PM UTC· resolved Sep 23, 2026, 05:00 PM UTC
- investigating Sep 23, 2026, 04:49 PM UTC
Services went down.
- resolved Sep 23, 2026, 05:00 PM UTC
Services recovered.
Minor June 15, 2026 Security Incident – Customer dashboard (Platform API)
Started Jun 15, 2026, 07:31 PM UTC· resolved Jun 15, 2026, 07:31 PM UTC
- resolved Jun 15, 2026, 07:31 PM UTC
Summary In June 2026 a security researcher participating in a bug bounty program reported that several API endpoints could return a record without authentication when a required query parameter was omitted entirely. We validated the report the same day, remediated the underlying cause across all affected endpoints, and verified the fix in production. Our review found no evidence of access by anyone other than the reporting researcher. The small number of customers whose records appeared in the researcher's testing were contacted directly. Reference: SEC-2026-08-01 What happened A set of lookup endpoints accepted an identifier as a query parameter causing the database filter to be dropped rather than rejected, and the query returned unauthenticated records. What was exposed Records included email addresses and internal IDs of client data. The researcher's testing touched records belonging to a small number of live customers. Those customers were notified directly. We have no evidence that any party other than the reporting researcher accessed these endpoints in this way. What we did Immediately, on validating the report: Fixed all affected end points Enabled an exhaustive PenTest suite covering our applicaitons (these now run quarterly along with nightly scans) Rotated and hardened tokens as well as an effected customer IDs. Verified the fix in production against each affected endpoint. Remediation was completed and deployed in June of 2026.
- investigating Jun 15, 2026, 07:31 PM UTC
--- ## Summary In June 2026 a security researcher participating in a bug bounty program reported that several API endpoints could return a record without authentication when a required query parameter was omitted entirely. We validated the report the same day, remediated the underlying cause across all affected endpoints, and verified the fix in production. Our review found no evidence of access by anyone other than the reporting researcher. The small number of customers whose records appeared in the researcher's testing were contacted directly. **Reference:** SEC-2026-08-01 --- ## What happened A set of lookup endpoints accepted an identifier as a query parameter causing the database filter to be dropped rather than rejected, and the query returned unauthenticated records. ## What was exposed Records included email addresses and internal IDs of client data. The researcher's testing touched records belonging to a small number of live customers. Those customers were notified directly. We have no evidence that any party other than the reporting researcher accessed these endpoints in this way. ## What we did Immediately, on validating the report: - Fixed all affected end points - Enabled an exhaustive PenTest suite covering our applicaitons (these now run quarterly along with nightly scans) - Rotated and hardened tokens as well as an effected customer IDs. - Verified the fix in production against each affected endpoint. Remediation was completed and deployed in June of 2026.