Fair Money & Economic Opportunity

Progress Software Corporation is a software company that provides application development platforms and data connectivity solutions, not a financial institution that lends, insures, moves, or stores money for consumers.

Therefore, all KPIs related to financial products, pricing, fees, lending compliance, debt, and customer financial outcomes are not applicable. The company's activities, such as charitable donations, STEM scholarships, and internal employee financial well-being sessions, do not fall under the scope of financial services for external underserved clients as defined by the rubric.

Fair Pay & Worker Respect

For fiscal year 2024, Progress Software Corporation reported a CEO-to-median-employee pay ratio of 100:1.

This ratio is calculated based on CEO Yogesh Gupta's total compensation of $10,374,886 and a median employee compensation of $103,957. In the prior year, the company's CEO-to-median-worker pay ratio was reported as 106:1.

Honest & Fair Business

Progress Software Corporation has not incurred any ethics-related regulatory fines in the past three years;

a recent SEC fact-finding investigation, which concluded in August 2024, did not result in a recommendation for enforcement action. The company provides a third-party ethics and compliance hotline, EthicsPoint, available 24/7 for anonymous reporting. For financial reporting, the company has not had any financial restatements in the past five years. The board of directors demonstrates a high degree of independence, with all directors except the CEO determined to be independent, and all members of the Audit, Compensation, and Nominating and Corporate Governance Committees meeting NASDAQ independence requirements. The company has an FCPA-compliant anti-corruption policy that limits gifts and entertainment to US$150 and requires suppliers to report unethical behavior, but the article does not specify the frequency or effectiveness metrics of training.

Planet-Friendly Business

Progress Software Corporation reported total Scope 1, 2, and 3 emissions of 4,367.51 t CO2e for Dec 2023 - Nov 2024, which represents a 0.9% increase from the previous period.

The company procures a minimum of 50% recycled content paper. Approximately 23% of office locations, primarily in India, are situated in areas with high overall water risk. Progress supports biodiversity through its "Adopt a Beehive" program in North Carolina and Bulgaria offices and contributes to the preservation of wild animals in Bulgaria.

Respect for Cultures & Communities

No cultural appropriation incidents, cultural site disruptions, or cultural incidents requiring a response framework have been reported in the provided articles.

Additionally, there is no mention of a formal cultural impact assessment protocol. Given the company's business model as a software provider, these aspects are noted as not applicable or without direct impact on cultural contexts.

Safe & Smart Tech

Progress Software has experienced major data breaches. By the end of 2023, the MOVEit vulnerability led to the compromise of over 2,700 organizations and exposed more than 93 million personal records.

In June 2024, a new critical authentication bypass vulnerability (CVE-2024-5806, CVSS 9.1) was disclosed in MOVEit Transfer, with exploit attempts reported. In September 2023, WS_FTP Server had two critical vulnerabilities (CVSS 10 and 9.9). The company is facing 58 to 118 class-action lawsuits and multiple government investigations by the SEC, FTC, and state attorneys general related to these breaches. Progress Software is certified to ISO/IEC 27001:2022, but its scope is limited to its Office of CIO and IT services for general administrative functions, not products. It also maintains annual SOC2 and HIPAA validation. The company has a vulnerability submission form with Service Level Objectives for first response (7 business days) and triage (10 business days). Patches for MOVEit vulnerabilities were provided on June 11, 2024, after disclosure on June 25, 2024, and for WS_FTP Server vulnerabilities in September 2023. Progress has a private bug bounty program and encourages responsible disclosure. Progress states that all systems and applications are protected by a defense-in-depth strategy, including encryption, and that cloud-based product offerings feature encrypted connectivity. However, no specific data on the percentage of data protected by strong encryption is provided. All employees undergo annual security training, but no completion rates or effectiveness metrics are available. The company's privacy policy indicates it collects, processes, and retains information as long as an account is active or as needed, without specific data minimization periods. User control over data is limited to a preference center for marketing emails. Progress has a zero-trust cybersecurity architecture approach and implements access control based on the least privilege model. The company performs source-code scanning, external penetration tests, and third-party deep-dive code assessments, but no specific coverage percentages are provided. Progress's Safe Harbor policy states that activities consistent with its vulnerability reporting policy will not result in legal action.