Trust Center
Welcome to the Yext Trust Center – your gateway to understanding our commitment to data security, privacy, and compliance. In this page, you can access our compliance documentation, find answers to frequently asked questions about security and privacy, and learn about our security practices.
We prioritize transparency and strive to build trust with our customers. This portal is designed to provide the information and assurance you need to feel confident in our ability to protect your data and safeguard underlying assets.
Documents
npm Supply Chain Attack "Shai-Hulud"
A new npm supply chain attack, referred to as “Shai Hulud”, has been reported in the security community. This incident involves the publication of malicious versions of specific npm packages to the ecosystem.
At this time, Yext has not identified any impact on our systems or services. We are continuing to monitor the situation closely and will take immediate action if new information becomes available.
What you should know about this incident:
The attack involves a self-replicating worm that spreads through npm packages.
Its goal is to compromise downstream applications through malicious package versions.
The issue is industry-wide and not specific to Yext.
If you have questions, please get in touch with us at security@yext.com.
Important Security Notice: Protect Yourself from Impersonation & Phone Scams
There's an important security issue we want to bring to your attention. We've recently noticed a surge in impersonation, email phishing, and phone spoofing attacks that involve our company name and contact numbers.
In these attacks, bad actors:
-
Send emails or messages pretending to be from Yext HR, Finance, or other teams
-
Call from phone numbers that appear to be Yext numbers (caller ID spoofing)
-
Ask recipients to share sensitive information or send payments
These communications are fraudulent and are not coming from Yext.
If you get a fraudulent communication, please forward it to security@yext.com. If you have already interacted with one, contact your internal IT team and ask them to escalate the incident to us.