The security team partners with reputable third-party security firms to perform specialized penetration tests across our infrastructure, products, and services, including Pure Storage FlashArray™, FlashBlade®, and cloud environments on an annual basis. Tests cover web applications, product features, code reviews, and threat modeling, thereby driving a robust security posture. Penetration test reports can be made available to customers upon request, subject to a mutual non-disclosure agreement (NDA).

Pure Storage does not process, store, or transmit customer data. Arrays are on-premise storage platforms that will remain under the customer's control. However we do receive system health and telemetry data which is stored in Pure1.

All data is encrypted with AES 256-bit encryption. This encryption is done at the firmware level and is not hardware dependent. Our data encryption occurs without impact on performance and while maintaining full data reduction capabilities. 

FlashArray and FlashBlade encryption are FIPS 140-3 certified, NIST compliant, NIAP/Common Criteria validated, and PCI-DSS compliant. The efficacy of our data encryption and data erasure have been validated by Kroll OnTrack, one of the industry’s leading security firms.

Pure Storage detects security incidents through continuous monitoring of all arrays, which report back to the Pure1® cloud-based monitoring system every 30 seconds with detailed telemetrics and every hour with a full activity log. This real-time data enables proactive identification and resolution of issues. The Incident Response Program promptly identifies, declares, and responds to security incidents, managed by our Security Operations team. 

In the event of a confirmed security incident or data breach, Pure Storage notifies customers in writing no later than 72 hours after becoming aware of the incident, including incidents where data is accessed by or disclosed to an unauthorized party, and follows an established Incident Response Procedure as per contractual agreements.

Yes. Pure Storage supports Single Sign-On (SSO) as the primary application portal, which requires multi-factor authentication (MFA). Multi-Factor Authentication is supported via RSA SecureID, and all applications published by Pure Storage IT require MFA. Pure1 provides SSO using SAML and can be integrated with the customer's Identity Provider. Purity OE supports SAML2-based SSO integration with Microsoft Active Directory Federation Services (AD FS), and SSO integration can optionally include MFA such as through a certificate or Microsoft Azure authentication. FlashArray supports SAML2.0, LDAP, and Active Directory integration for authentication and role-based access control. Administrative accounts can be integrated with Microsoft Active Directory or OpenLDAP, enabling granular administration and role assignment.