Legal

Privacy Policy

Effective Date: 2026-11-05 (Version 2026.8)

Effective Date: November 5, 2026 (Version 2026.8)

This policy explains what personal data DVSentry collects when you use the DVSentry platform at dvsentry.com, why we collect it, how long we keep it, who else handles it, and the rights you have. It is written for the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (India), and also covers the main rights you have under the EU and UK General Data Protection Regulation if you use DVSentry from those regions.

Features and the providers we use may change; when they do, we update this policy as described in section 13.

1. Who we are

DVSentry is a DevSecOps security platform built and operated in India by [Legal entity name: to be published] ("DVSentry", "we", "us"), [Registered address: to be published]. For the purposes of the DPDP Act we are the Data Fiduciary, and under the GDPR the controller, for the personal data described here.

When your organization uses DVSentry to scan its own code, websites, cloud accounts, AI systems or infrastructure, your organization decides what is scanned. For personal data that happens to sit inside those systems, your organization is the Data Fiduciary (controller) and DVSentry processes it only to run the scans your organization asks for, under our Data Processing Addendum.

Contact: privacy@dvsentry.com. Grievance Officer: Aslam Jabri, privacy@dvsentry.com.

A short, standalone notice of what we collect and why, written for the DPDP Act, is at /dpdp-notice. You give your consent against that notice when you create an account.

2. The data we collect

Account data. Your name, email address, username and password. We store your password only as an Argon2id hash, never in readable form. If you turn on multi-factor authentication we store the authenticator secret encrypted and your recovery codes only as hashes. If you add a passkey we store its public key, never a private key. If you sign in through your company's single sign-on we store the identity provider's identifier for your account.

Organization data. Organization names, members, roles, teams and invitations. For paid plans, the billing details you give us: legal name, billing address or state, and GSTIN if you have one.

Payment data. Payments are handled by Cashfree Payments. DVSentry never receives or stores your card number, UPI PIN or bank login. To set up a monthly mandate, we pass Cashfree your account email and the mobile number you enter at checkout; we do not store that number. We receive from Cashfree a payment or subscription reference and its status.

Scan targets and results. The things your organization asks DVSentry to test: repository addresses, domains and web applications, cloud account identifiers, AI endpoints, Kubernetes clusters and machines running the DVSentry agent. The results: findings, reports, evidence, scores and the history of each finding. Findings can include file paths, line numbers and short code excerpts needed as evidence, and some cloud and Kubernetes findings name accounts, roles or service identities.

Source code. To scan a repository we make a temporary copy of it in an isolated workspace and delete that copy when the scan finishes or fails. We do not keep a copy of your source code after the scan, apart from the short excerpts that appear in findings as evidence.

Contributing developers. To count contributing developers for pricing, DVSentry reads the commit authors of the last 90 days in each repository your organization scans and reduces each one to a one-way SHA-256 key, salted per organization. Bots are dropped. We never store a contributor's name or email address, and the keys are deleted with the report they came from. Contributors may not be DVSentry users; your organization is responsible for telling them, as it is for the rest of the code it scans.

Credentials you give us. Access tokens, cloud credentials, API keys and sign-in profiles for scans are treated as secrets. A token you give for a single scan is kept in memory only for that scan and is never written to our database. A credential you choose to save is stored encrypted and is decrypted only to perform the scans you ask for. We never show a saved secret back to anyone. Keyless cloud connections store no secret of yours at all.

Secure Share. Messages and files you send with Secure Share are encrypted in your browser before they reach us, and the key never reaches us, so we cannot read them. We keep the encrypted data until the share expires, is used up or is revoked, and we keep who sent it, to whom, its size, timer and view count, so the service works and abuse can be handled.

Sign-in and security records. When you sign in or perform sensitive actions we record the time, your IP address, the browser's user agent and the result, so we can protect your account, detect abuse and investigate incidents. Actions taken in your organization are written to an audit log your administrators can read. When you sign in to the DVSentry IDE extension, we keep a short-lived sign-in code for ten minutes (only as a hash) and then the read-only token it creates, which you can see and revoke in Settings.

Messages and support. If you email us or answer a survey, we keep that correspondence.

Product preferences. Whether you agreed to optional product analytics and to product news. Both are off unless you turn them on in Settings. DVSentry does not collect product analytics today; the setting records your choice in case we add them, and we will update this policy first.

We do not buy personal data, we do not use advertising trackers, we do not use your data to train AI models, and we do not sell your data to anyone.

3. Why we use it

• To provide the service: create and secure your account, run the scans you ask for, show you results and reports, and send the emails the service depends on (verification codes, password resets, invitations, scan and security alerts).
• To keep DVSentry secure: authenticate you, prevent fraud and abuse, enforce the limits of your plan, and investigate incidents.
• To bill you: take payments through Cashfree, count the contributing developers and cloud accounts your plan includes, and issue GST invoices.
• To improve DVSentry: understand which features work and fix problems, from operational measurements that do not identify you.
• To meet legal obligations: tax and accounting records, and responding to lawful requests.

Under the DPDP Act we process your personal data on the basis of your consent, which you give when you create an account by ticking a separate box against our DPDP notice (we record which version you agreed to and when), and for the legitimate uses the Act allows. For users in the EU and UK, the legal bases are performance of our contract with you, our legitimate interest in keeping the service secure and in pricing it fairly, your consent for optional analytics and product news, and compliance with legal obligations.

4. How long we keep it

• Account data: for as long as your account exists. When you delete your account it is removed straight away, with your sessions, access tokens, MFA settings and passkeys.
• Reports, findings and evidence: for the retention period your organization sets (90 days by default, adjustable between 30 and 365 days). Contributor keys go with the report.
• Sign-in records and security events: kept for one year, as the DPDP Rules ask of security logs; IP addresses in sign-in records are masked after 30 days.
• Website access logs (IP address, country, page, response status and time of each request to dvsentry.com): one year, then deleted, as the DPDP Rules ask of security logs. They are used only to keep the service secure and to count visits. Secure Share links are never written to them.
• Audit log: up to 365 days.
• Attack-surface monitoring evidence: 365 days, apart from the latest completed run for each domain, which is kept as the baseline for change detection.
• Kubernetes posture results and cloud runtime detections: 90 days.
• Temporary repository copies: deleted when the scan finishes.
• Saved answers for safe retries: when your browser or a tool retries a request, we keep an encrypted copy of the first answer for 24 hours so the retry does not act twice.
• Secure Share: the encrypted content is deleted at the last permitted view, on revocation, or when the timer (at most 72 hours) runs out; the share's record is deleted a day after it expires, unless a recipient reported it, in which case it is kept while the report is reviewed.
• Free public repository scans (/scan): the result summary for 7 days; your IP address only as a keyed fingerprint for fair-use limits, deleted with it; an email address you give only until the one result email is sent.
• Exports and downloads you request: 72 hours. Dependency fix patches: 1 hour.
• Backups: encrypted database backups roll off within 35 days, so deleted data can remain in them until then. They are used only to restore the service.
• Organization deletion: when an owner deletes an organization, its data is deleted. When DVSentry closes an organization (for example at the end of a contract), it is first suspended for 60 days, then its data is deleted and an encrypted archive is kept for 90 days before it is purged.
• Billing records and invoices: as long as Indian tax and accounting law requires.

5. Who else handles your data

We use a small number of service providers (sub-processors). Each receives only what it needs to do its job. The current list is also in the Data Processing Addendum, and we update it before adding a new one.

• Google Cloud (hosting, Mumbai region, India): runs the DVSentry servers, database and backups where your data is stored.
• Cloudflare (network and security): sits in front of dvsentry.com, carries your traffic to us and blocks attacks. It sees your IP address and requests in transit.
• Resend (email delivery, United States): sends the transactional emails listed in section 3. It receives your email address and the message.
• Cashfree Payments (payments, India): processes subscription payments and mandates; receives your email and the mobile number you enter at checkout.
• GitHub: only if you connect repositories hosted on GitHub or install the DVSentry GitHub App. We use it to read the repositories you choose and to post scan results back as checks.
• AI model providers (Google Gemini for platform-managed AI; OpenAI, Anthropic, Google Gemini, Groq or another endpoint your organization chooses with its own key): only when you use AI features. AI explanations, triage and remediation advice send the finding details needed to answer, with secrets removed. We do not send your repositories to them.
• Slack and Microsoft Teams: only if an administrator of your organization installs the DVSentry app. Alerts posted to the channels they choose carry finding titles, severities and locations (never descriptions or evidence), and actions taken in chat record your chat user id.

Have I Been Pwned (contacted by your browser, not a sub-processor). If you turn on breach checks in the Password Vault, your own browser asks Have I Been Pwned's Pwned Passwords service whether a password appears in known data breaches. It sends only the first 5 characters of the password's SHA-1 hash and compares the answer on your device; the password never leaves your browser. Have I Been Pwned sees that fragment and your IP address. DVSentry receives nothing from these checks, not even which entry was checked; the results are kept inside your encrypted vault. You choose this when you set up a vault and can turn it off in the vault's settings.

When your organization asks DVSentry to monitor a domain, the domain name is looked up in public certificate-transparency and passive DNS sources. When you scan your own cloud account or AI system, DVSentry connects to that provider using the access your organization granted.

We may also disclose personal data when the law requires it, to protect the rights and safety of our users or the public, or as part of a business transfer, in which case this policy continues to apply to your data.

6. Where your data is stored

Your data is stored in India, in Google Cloud's Mumbai region. Some providers above, such as Cloudflare, Resend and the AI providers, may process data in other countries. We transfer data outside India only as the DPDP Act permits and, for EU and UK users, with appropriate safeguards such as the European Commission's standard contractual clauses and the UK addendum to them.

7. How we protect it

• All traffic is encrypted with TLS.
• Passwords are hashed with Argon2id; sessions and access tokens are stored only as hashes.
• Saved credentials are encrypted at rest and decrypted only for the scan that needs them.
• Multi-factor authentication and passkeys are available to every account.
• Each organization's data is separated in the application and, for sensitive tables, by database row-level security.
• Scanners run in isolated, signed containers with no network access and no access to our database or platform secrets.
• Every service connects with its own least-privilege database role, and audit records cannot be edited.

No system is perfectly secure. If a personal data breach affects you, we will tell you without delay, in plain words, what happened, when, what it may mean for you, what we are doing about it and what you can do. We tell the Data Protection Board of India without delay and send it a full report within 72 hours, as the DPDP Rules require, report it to CERT-In where its directions apply, and inform the relevant supervisory authority where the GDPR applies.

8. Your rights

You have the right to:

• Access a summary of your personal data and how we process it. Settings > Legal & Privacy lets you download an export of your account data at any time.
• Correct and update your data. Most of it you can change yourself in Settings.
• Erase your data. You can delete your account in Settings; organization owners can delete their organization.
• Withdraw consent at any time, for example by turning off analytics or product news in Settings, or by deleting your account. Withdrawing consent does not affect processing that happened before.
• Grievance redressal. Contact our Grievance Officer at privacy@dvsentry.com. We acknowledge a grievance within 24 hours and resolve it within 15 days. If you are not satisfied, you can complain to the Data Protection Board of India.
• Nominate another person to exercise your rights if you die or become unable to.

If you are in the EU or UK you also have the right to restrict or object to processing, to data portability, and to complain to your local data protection authority.

To use any of these rights, email privacy@dvsentry.com from the address on your account. We may ask you to confirm your identity first. If your data came to us as part of your organization's scans, we will pass your request to that organization.

9. Cookies and browser storage

DVSentry uses only cookies that are needed for the service to work, and no advertising, analytics or cross-site tracking cookies:

• dv_shield_session keeps you signed in. It holds a random token; we store only its hash. It ends when you sign out or the session expires.
• dv_shield_csrf protects your actions against cross-site request forgery, for the length of your session.
• dv_sso_binding, dv_saml_binding and dv_sso_second_factor tie a single sign-on attempt to the browser that started it, for a few minutes, only when your organization uses single sign-on.
• dv_passkey_binding ties a passkey sign-in to the browser that started it, for a few minutes.
• dvs_share_lease lets a recipient finish downloading a Secure Share file they opened, for the length of the download.

The app also keeps a few interface preferences in your browser's local storage, such as whether the side menu is collapsed and which notices you dismissed. They never leave your browser. Cloudflare may set its own strictly necessary security cookies to tell people from bots. Because all of these are strictly necessary, there is no cookie banner; blocking them will stop you from signing in.

10. Children

DVSentry is a professional tool and is not intended for anyone under 18. Everyone who creates an account confirms they are 18 or older, and we record that confirmation. We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.

11. Your organization's responsibilities

Only scan systems your organization owns or is authorized to test. If those systems hold other people's personal data, including the commit history of your developers, your organization is responsible for having a lawful basis to have them tested and for telling the people concerned. Our Acceptable Use Policy, DAST Authorization Agreement and Data Processing Addendum describe this in detail.

12. Feedback requests

We may contact you to ask for feedback about DVSentry. You can tell us at any time that you do not want to be contacted. Accounts on an early access trial and their data are treated under this policy like any other account, and stay in your organization when the trial ends unless you delete them.

13. Changes to this policy

We will publish any change on this page with a new version number and effective date, and ask you to read it in the product. If a change is significant, we will also email account owners before it takes effect.

14. Contact

Questions, requests and complaints: privacy@dvsentry.com. Security vulnerabilities: security@dvsentry.com, under our Vulnerability Disclosure Policy.