DVSentry systems initializingOverview
Security posture
Getting started
Reach your first useful security result
Complete the next safe step. You can return here at any time.
DVSentry never writes to the repository unless an Admin turns on fix pull requests for it. Private credentials are accepted only for the selected action, a short encrypted reuse window, or through the organization's Scan credentials.
Risk posture
Nothing is measured yet.
Complete a scan on any attack surface to record a posture.
- Critical findings
- —
- High findings
- —
- Running scans
- 0
- Policy pass rate
- —
Attack surfaces
Coverage from your latest assessmentsGitHub App
Governance
Security policies
Decide what passes and what fails. A policy reads the normalized findings of a report. It can apply to every pillar, to one pillar (repository, web and network, cloud, AI or resilience), or to a single repository, in one environment or all.
Active guardrails
Simple rules, clear scope, and an outcome every team can understand.
Account Security & Multi-Factor Authentication
Email and MFA status load with your account.
Save these 10 one-time recovery codes in a secure offline location. Each code can be redeemed once if you lose access to your authenticator app.
When you have saved them, choose "I've saved them" to go back to what you were doing.
A passkey on this device or your phone can confirm sensitive actions instead of the six-digit code. Your authenticator app and recovery codes keep working.
Active Sessions & Device Management
Review active browser sessions, IP origins, and revoke remote devices.
Personal access tokens
Tokens your CI jobs, the command-line client and your editor use. Revoke one here and it stops working at once.
Connect your editor: install the DVSentry extension, run "DVSentry: Sign in" and approve the code it shows. The extension gets a read-only token for one organization that ends after 30 days.
Copy this token now. DVSentry stores only a hash, so it is shown this once.
Platform Readiness
Checking local services…
Disaster Recovery & Incident Response Readiness
DR readiness checks inspect configured backup metadata and database access. A separate isolated restore procedure is required to prove recoverability. Emergency containment locks down sessions during active incidents.
Scanner Fleet Health
Versions are compared with DVSentry's tested minimums. No vendor telemetry is contacted.
Intelligence Database
Scanner versions
Scanner engines are pinned and upgraded deliberately: a newer scanner can change output format, severity mapping and detection behaviour. Vulnerability databases and rules refresh separately on their own schedule.
Upgrade history
Scanner Trust & Updates Console
Cryptographic signature verification, SLSA provenance attestation, scanner image digests, database update freshness, and air-gapped offline updates.
Confirms the runtime image signature before execution.
Technical details
...Confirms where the scanner image came from and how it was built.
Technical details
...0 KEV · 0 EPSS
Update details
Supports signed database updates in disconnected environments.
Technical details
NoneNoneOffline Signed Scanner Bundle Guide
- Private signing keys are NEVER uploaded or stored on DVSentry. Keep signing keys offline in a secure HSM or offline workstation.
- No arbitrary paths or URLs are permitted. All bundles, signatures, and public keys must reside strictly in
/offline-updates/. - Every administrative action is recorded in the organization audit trail.
Import Staged Offline Bundle
Files must already be placed in /offline-updates/. Enter the relative filenames below.
Installed Scanner Versions & Image Digests
Installed engines and their tested compatibility floor. Image metadata is available under Details.
| Scanner | Status | Tested Floor | Last Run | Technical metadata |
|---|---|---|---|---|
| Loading scanner inventory... | ||||
Repository Automation & Triggers
Schedule recurring scans or create a revocable API trigger. Private repository credentials are never stored in schedules or triggers.
Create / Edit Scan Schedule
Active Schedules
Create API CI/CD Trigger
Configured Triggers
GitHub App
No scan starts on its own: tick the boxes below only if you want DVSentry to scan every push to the default branch and every same-repository pull request automatically (posting a GitHub check). Pull requests from forks are never scanned.
Push webhooks (GitLab, Bitbucket)
Scan every push to one branch of a GitLab or Bitbucket repository. DVSentry gives you a webhook URL and a secret; add them to the repository's webhook settings. A private repository needs a read-only access token saved in Scan credentials.
Fix pull requests
With a separate GitHub App, the DVSentry Fix App, an Admin can ask DVSentry to open a pull request that moves one vulnerable dependency to its fixed version, only on repositories turned on here. You review and merge it; DVSentry never merges.
Automation Execution History
Production Email Delivery Provider
Email infrastructure dispatching verification tokens, account recovery, and security alerts.
Notification Delivery Channels
Deliver durable alerts by email, allow-listed webhook, or Slack-compatible webhook. Destinations are encrypted at rest and never revealed again.
Issue tracker sync
Open one Jira or GitHub issue per finding at or above a severity, close it when a scan shows the finding fixed, and reopen it if the finding comes back. The token is encrypted and never shown again. Descriptions and evidence are never sent.
Signed event webhooks
Send versioned DVSentry events to a signed HTTPS webhook, Microsoft Teams, PagerDuty or Opsgenie. Webhooks are signed with HMAC-SHA256; the signing secret is shown once. Finding descriptions and evidence are never sent.
Slack and Microsoft Teams app
Post DVSentry alerts to the channels you choose. Linked members can acknowledge, assign to themselves or snooze an alert from the message; anything that changes a finding's security state stays in DVSentry. The bot only posts: it never reads your messages. Finding descriptions and evidence are never sent.
Legal Governance & Regulatory Disclosures
Every legal text is also published at dvsentry.com/legal.
The agreement for using DVSentry: what you may test, how your code and data are handled, fees, liability and disputes.
What we collect, why, how long we keep it, who handles it, and your rights under the DPDP Act and the GDPR. Also at dvsentry.com/privacy.
What you may test, what is never allowed, and how DVSentry responds to misuse.
The authorization you confirm before active web, API and network scans, and how those scans are bounded.
How long each kind of data is kept, how it is deleted, and how long backups hold it.
How DVSentry processes personal data in the systems you assess, its sub-processors and breach notice.
Plans, trials, GST, failed payments, cancellation and refunds.
Availability targets and support on every plan.
Your licence to run the agent, command-line client and IDE extension.
End-to-end encrypted sharing: no recovery, not scanned, reports and takedown.
Extra terms while your organization uses an early access trial.
How to report a vulnerability in DVSentry and our safe harbour for good-faith research.
Telemetry & Analytics Consent
GDPR & CCPA Data Portability Export
Download a complete, machine-readable JSON archive of your personal profile, memberships, repositories, and activity.
Generates an authenticated cryptographic archive containing your account metadata, organizations, scan references, and privacy logs in compliance with GDPR Article 20 and CCPA data portability mandates.
What you have accepted
The legal texts you accepted with this account, which version and when. Every text is published at dvsentry.com/legal.
Loading your acceptances…
Full record
What your organization's members accepted
Agreements accepted on behalf of this organization: the DAST agreement and active web-scan authorizations, the Resilience Testing Authorization and the Fix Pull Requests Authorization.
Loading organization agreements…
Multi-factor authentication
Disabling MFA weakens account protection and revokes all recovery codes.
MFA required by security policy
Data Retention & Privacy Policy
Collected Sign-in Metadata: When authenticating, DVSentry records timestamp, username, authentication method (token, session, MFA), device summary (browser/OS), masked IP address (***.***), and approximate geographic location.
IP Address Security: Client IPs are accepted only from explicitly configured trusted reverse proxies. Full IP addresses are encrypted at rest using AES/Fernet encryption keys. Unmasking an IP address requires active creator re-authentication and a mandatory audited business justification. Keyed HMAC fingerprints are used to detect credential stuffing and abuse without storing raw IP data.
Offline Local Geolocation: Geolocation resolution is performed strictly using offline local database tables. DVSentry never calls third-party geolocation or telemetry APIs during login or scan operations. All geographic locations are approximate.
Configurable Retention: Sign-in records are automatically anonymized after 30 days (purging encrypted IPs, user agent strings, and IP fingerprints) and permanently deleted after 90 days. Report evidence bundles are pruned according to organization retention settings.
Zero Tracking Promise: DVSentry does not use invasive page tracking, analytics trackers, hardware fingerprinting, or continuous location polling.
Account & Organization Deletion: Deletion is immediate, zero-trace, and permanent. Deleting an account immediately revokes all active sessions, deletes MFA credentials, and cascades deletion across all personal and organization records.
Delete Personal Account
Permanently remove your account, MFA keys, active sessions, and personal preferences.
Delete Organization
Permanently wipe this entire organization, including repositories, scan histories, policies, and member access.
Select Web Target
HTTPS Productionhttps://app.example.com
1 Targets
Web endpoints on domains you have verified. Select one.
Add a Web Target
Register an endpoint against a verified domain. Production requires HTTPS.
▾
Register an endpoint against a verified domain. Production requires HTTPS.
2 Run
Passive checks by default; active tests need your authorization.API security and role comparison scans use an imported description instead of looking for /openapi.json. Only endpoint shapes are kept: header, cookie, query and body values are dropped, and requests to other hosts are left out.
A state-changing check sends each request below once, as the lower-privileged identity, and may change data on the target. DELETE is never sent. Consent covers exactly this list and lapses when the description is re-imported.
A sign-in profile lets a role comparison log in as two accounts and find what the lower one can reach but should not. Secrets are stored encrypted, used only by the scan worker and never shown again. A schedule runs a bounded active scan on its own; each run re-checks the domain's TXT record first and is skipped with the reason if it is gone.
Only an Admin can add sign-in profiles or schedules. You can run a role comparison between saved profiles.
Sign-in profiles
Add a sign-in profile
Compare two roles
Scheduled active scans
3 Results
Full findings are in Findings and Reports.Perimeter Exposure
ReadyTop Findings
No web vulnerabilities detected.
Recent Runs
No recent assessment runs.
External Attack Surface
What has been observed?
Inventory combines registered targets, existing scan evidence, and bounded DNS. Candidate names and resolved IPs are not automatically authorized for active scanning.
Open this view to load inventory.
Inventory
Exposure changes
Domain ownership
Domain Verification
Verify ownership, then choose this domain in Web & Network or AI Security. Reverify the existing TXT record whenever a new ownership check is needed. This only performs a DNS TXT lookup; DVSentry never contacts or scans your website during domain verification.
No target selected
No agent connected Development OnlyDevelopment targets only · Emergency stop always available
Real fault testing
LockedReal faults are off for every organization. They open only after your Owner requests them, accepts the Resilience Testing Authorization, and DVSentry grants the request for a limited time. Each run then needs approval from a second Admin or Owner.
What this test checks
These tests check whether your users keep being served while one approved fault affects a named development target. The fault, limits and target are shown on each run before approval.
- Before: the target passes the safety checks and its health check answers.
- During: the bounded fault is applied and the service response is measured.
- After: the fault is undone and the service recovers within your objective.
Resilient means all three held. Resilience failure means users would have seen errors or slow recovery, and a finding is opened. If recovery cannot be confirmed, further runs are blocked until someone reviews the result.
Connect an environment
- Choose your environment
- Install the agent
- Verify its inventory
- Choose a target
Install with one command
DVSentry writes one command with a fresh ten-minute, single-use enrollment token in it. Paste it on the machine as a user with sudo. It detects a Linux VM or a Kubernetes cluster (including k3s), installs the read-only agent (host posture on a VM; Kubernetes posture and node checks in a cluster), and enrolls it. The same agent also runs the posture scans on the Infrastructure page. DVSentry never receives a host or cluster credential, and no fault is enabled: real resilience faults stay locked until you register a target and grant it.
Leave empty for a read-only agent. With a service named, the agent may stop/restart that one service and run CPU/memory stress, still only after a grant, an approval and a target pin on the VM.
Or follow the manual install steps. They come directly from the agent README; use them for resilience fault capabilities. Keep credentials on your own environment.
Loading install steps…
Names only. Your operator pins each query, comparison and threshold in the agent's trust file; DVSentry never sends a query.
Only an organization Owner can request real fault testing.
GameDays
Plan up to eight runs in order. A different Admin or Owner approves the whole plan once; you still start every step yourself, after the previous step passed. A failed or inconclusive step stops the GameDay.
Prove that a service recovers from bounded faults. Experiments run only against verified development targets, need Admin approval, and can be stopped at any time.
01Plan a verified experiment
Probes and simulations only · no real fault is injected here
Chaos plan history
02Connect a trusted agent
Trusted agents
Organization admins create a ten-minute, single-use enrollment token. The installed agent exchanges it for a credential shown only once, then sends outbound heartbeats. No fault commands are enabled.
Kubernetes posture
Your agent reads the cluster with a read-only role and sends configuration facts only: RBAC, workload security settings, NetworkPolicies and admission configuration. DVSentry never holds a cluster credential and never reads Secrets or ConfigMaps. Apply dvsentry-kubernetes-posture-rbac.yaml and add kubernetes_posture_read to the agent's capabilities first.
03Configure simulation controls
Simulation control
http://chaos-demo:8080/health. It delays only the agent's own request path, never other users, and stops automatically after 10 seconds.04Review approvals and evidence
Experiment approvals and history
05Scheduled Game Days & DR Drills
Scheduled Resilience Game Days
Automate periodic game days on a resilience calendar. Completing game days awards team XP (+150 XP each) and boosts Developer Scorecards.
Execute schema integrity verification and database checksum validation under synthetic chaos conditions to verify backup RTO/RPO.
Active Operational Boundaries
Fault injection locked to verified development targets.
Automatic abort on response latency spike or error threshold breach.
Cryptographically verifiable probe timelines and audit traces.
Steady-State Verification
Administration
Organization
Members, roles, teams and invitations, plus the encrypted vault for shared credentials. Every change is recorded in the audit trail.
Members
People with access to this organization and their role.
Teams
Group people around services, products or on-call responsibilities.
Invitations
Invite someone by email. They join with the role you choose once they accept.
Single sign-on
Let members sign in with Google Workspace, Microsoft Entra ID or Okta (OpenID Connect), or with any SAML 2.0 identity provider where your deployment allows it. Prove each email domain with a DNS TXT record first. The client secret is encrypted and never shown again. Only owners change these settings, after a recent MFA check.
Redirect URI to register at your identity provider:
Register DVSentry at your identity provider with the Assertion Consumer Service URL , the entity ID (audience) and the metadata at . Sign the assertion or the response, leave assertion encryption off, and send the email address as the NameID or an email attribute.
Provisioning (SCIM)
Let your identity provider add and remove members and keep teams in step with its groups. Users must be on an email domain verified under Single sign-on. Provisioned users join as the role below; SCIM never grants Admin or Owner and never removes an Owner. The token is shown once. Only owners change these settings, after a recent MFA check.
SCIM base URL:
Copy this token into your identity provider now; it is not shown again:
Service accounts
Non-human members for CI and automation. They never sign in, are never Admin or Owner, are not seats, and act only through tokens confined to this organization. Admins manage them from a signed-in browser, after a recent MFA check.
Service accounts are not enabled on this platform.
API token IP allow-list
Limit where this organization's API tokens (personal and service-account) can be used from. Browser sign-in is not affected. Empty = any address.
The token IP allow-list is not enabled on this platform.
Password vaults
Members' vaults by name, owner and size. DVSentry cannot read them and Admins have no way in: no key, no entry, no recovery. Removing a member deletes their personal vaults.
Scan credentials
DVSentry can decrypt these to run scans. Encrypted credentials such as private GitHub tokens and AI provider keys. Values are write-only: once stored, they are never shown again. For your own passwords, use Password vault, which DVSentry cannot read.
Create another organization
Administration
Billing & Subscriptions
Your plan, what this organization has used, and your invoices.
Loading…
Loading your plan…
Stop renewal? You keep this plan until the end of the period you paid for, then the organization moves to Free (7-day retention, so older reports are deleted).
Resource Usage Meters
Security usage
Usage by assessment surface, exactly as reported by the billing service.
Plan units
AppSec is priced per contributing developer and Cloud per connected cloud account. Going over what your plan includes is a soft limit: we will ask you to upgrade, nothing is blocked.
Promo code
A promo code from DVSentry unlocks a plan or features for a set number of days, free. It never lowers what you already have, and when it ends your own plan applies again; reports and findings stay.
Evaluation access
Promotional scan credits from DVSentry. Credits are used before your plan's quota and expire on the date shown; your reports and findings stay after they expire.
Available Subscription Plans
AppSec is priced per contributing developer and Cloud per connected cloud account; add-on packs (+5 developers, +1 cloud account, Burnwatch) are arranged with us and invoiced until checkout sells them. Complete is billed by contract. A scan is one run of one asset in any pillar; GitHub App pull-request and push scans are fair use and not counted.
GST details
GST at 18% is added to rupee payments. A business that enters its GSTIN gets it on every invoice to claim input tax credit.
Invoices & Billing History
Governance
Trends
How open findings, regressions and remediation time change across your reports, for every pillar or one at a time.
Regressed Vulnerabilities
0Multi-Cloud Posture
AWS ProductionConfigure cloud credentials to audit storage, network, and IAM posture
1 Cloud accounts
Read-only identities, encrypted at rest. Select one.Threat detections your cloud provider has already raised (AWS GuardDuty, Microsoft Defender for Cloud alerts or Security Command Center threat findings), read during each full posture scan. DVSentry stores the type, severity and affected resource of each detection, never addresses, names or descriptions, and deletes them 90 days after a scan last saw them. This is not an alerting system: your provider's console is the source of truth.
Which running services run an image built from your repositories, and whether the internet reaches them: ECS on AWS, Cloud Run on Google Cloud, Container Apps on Azure, and Kubernetes workloads (EKS, GKE, AKS) through your DVSentry agent. DVSentry lists services and the image digests they run; it never reads task definitions, environment values, secrets, tags or addresses. Each link says how it is known, and only a chain where every link is observed or verified is stated as complete.
Package lists read from EBS snapshots you tag dvsentry-scan=true, matched against the offline vulnerability database in the isolated scanner. DVSentry never creates, copies or shares a snapshot or volume, and keeps only package names and versions. Windows and instance-store volumes are not read.
Connect Cloud Provider Credentials
Keyless where supported; each provider's form shows its options
▾
Keyless where supported; each provider's form shows its options
2 Run
Audits against CIS benchmarks, SOC 2 and ISO 27001 controls.3 Results
Each assessment's findings are read in Reports.Container images
Scan one image by digest for package vulnerabilities and embedded secrets.DVSentry pulls the image once with a short-lived registry token, checks every layer against its digest and scans it offline. Amazon ECR, Google Container Registry / Artifact Registry and Azure Container Registry images are pulled with a cloud account an Admin has allowed below; ghcr.io images with the organization's GitHub App installation.
Image pull access
A cloud account's posture credential reads configuration only. Pulling an image reads its contents, including anything baked into it, so no account pulls images until an Admin allows it here. Changes are audited.
Hosts and Kubernetes nodes
Operating system checks and packages of your Linux VMs and Kubernetes clusters, read by the DVSentry agent you install with one command, or by your cloud's own inventory. No cloud account is needed to scan a VM or a cluster.
Start here
Choose what to scan. A VM or a cluster needs only the DVSentry agent: one command, read-only, outbound only, and DVSentry never holds an SSH key or a kubeconfig. A cloud account is optional.
Connect a cloud account: optional, independent of the agent
The agent scans a VM or cluster on its own; no cloud account is needed. A cloud account is connected once, in the Cloud pillar, and then adds to Infrastructure:
- Package lists of your cloud VMs that the cloud already collects (AWS Systems Manager Inventory, Google Cloud VM Manager, Azure Update Manager), read by the full posture scan, with no agent on those VMs. An Admin allows this per account under Hosts below.
- Cloud posture of the account itself (configuration, exposure, identities), shown in the Cloud pillar.
- Links from your clusters' running images back to code (code-to-cloud), where you allow them.
Install the agent with one command
Hosts
Installed packages of your VMs, matched against known advisories. The agent reads them on each VM it is installed on; a connected cloud account's full posture scan can also read them from AWS Systems Manager Inventory, Google Cloud VM Manager or Azure Update Manager, which an Admin allows per account below.
Kubernetes nodes
DVSentry's own checks of kubelet, control-plane and node file settings, read by the optional node checks DaemonSet and sent through your posture agent. The one-command install (Scan a Kubernetes cluster above) sets both up; by hand, apply dvsentry-node-checks.yaml and add kubernetes_node_checks to the agent's capabilities. Then press Scan on the cluster below. These are not CIS Benchmark controls.
What is checked
Agent hosts
Operating system checks and installed packages of your own Linux VMs, read by the DVSentry agent you install there (Scan a VM above, or by hand with dvsentry-host-posture.service and the host_posture_read capability; no root, no sudo). A scan reads settings and the package database once and sends parsed values only. These are DVSentry's own checks, not CIS Benchmark controls.
What is checked
Runtime alerts
Falco (open source) alerts from the last 24 hours, forwarded by your agent with the runtime_alerts_falco capability: rule, priority and workload only, never Falco's output text. Tick the Falco option when you generate the install command (Scan a VM or Scan a Kubernetes cluster above), or install Falco yourself with JSON output; in a cluster also apply dvsentry-falco-logs-rbac.yaml. Admins get one notification per rule and day for warning and above.
Vulnerability data and its licences: Data sources and attribution.
LLM & Agent Systems
Chat Application ProductionTarget: Select target · Auth: Bearer / API Key · Bounded Security Probes
1 Targets
The AI endpoints you test. Select one.
Add a target
A chat application, model API, RAG system or agent you own
▾
A chat application, model API, RAG system or agent you own
2 Run
3 Results
AI in your repositories (AI bill of materials)
Which AI SDKs, provider APIs, models and credential names each repository uses, from its newest repository scan. Credentials are listed by environment variable name only; DVSentry never reads a key's value.
What an assessment tests · the attack categories checked (OWASP LLM Top 10), and how the last run did on each ▾
Resources
Security intelligence
Vulnerability intelligence from CISA KEV, NVD, OSV and GHSA, matched to your environment. Links open at the publisher; no repository, finding or account data is sent.
Every source and its age
Advisories and news
External articles open at their official publisher. DVSentry does not proxy clicks, attach tracking parameters, or share private platform context.
Activity
Alerts
What needs your attention and what changed. Alerts are private to you; audit events contain security metadata only.
Your alerts
Report completions, failures, and access changes that need attention.
Organization activity
Immutable audit metadata. Credentials, source code, scanner output, and secret matches are never recorded.
Audit log export and SIEM streams
Sealed audit rows with their hash chain, so you can verify them yourself. Admins only.
Streams
Platform owner
Creator Console
Deployment-wide controls. Every sensitive action, including full IP reveals, is recorded in a tamper-evident audit trail.
Platform Accounts
| Username | Email Verified | MFA | Status | Masked IP | Actions | |
|---|---|---|---|---|---|---|
| Loading platform accounts… | ||||||
Organizations & Trial Grants
| Organization | Base Plan | Subscription Status | Custom Trial | Members / Repos | Created | Actions |
|---|---|---|---|---|---|---|
| Loading organizations… | ||||||
UPI Direct Payments & Verifications
Review submitted 12-digit UPI UTR transactions from Indian customers, verify receipts, and activate plans.
| Organization | User | Plan | Amount | UTR Number | Payer VPA | Status | Submitted | Actions |
|---|---|---|---|---|---|---|---|---|
| Loading UPI payments… | ||||||||
Sign-in Visibility & Activity
Audited sign-in trail. Full IP encrypted at rest; locations resolved from offline database.
| Timestamp | Account | Method | Device | Masked IP | Approx. Location | Result | Actions |
|---|---|---|---|---|---|---|---|
| Loading sign-in activity… | |||||||
User Feedback & Scanner Quality
| Date | User | Category | Rating | Message | Finding Ref | Status | Actions |
|---|---|---|---|---|---|---|---|
| Loading user feedback… | |||||||
Platform Audit Trail
Survives organization deletions. Independent platform-wide record of creator activity.
| Action | Target | Reason | Operator IP | Timestamp |
|---|---|---|---|---|
| Loading audit trail… | ||||
Not on this organization's plan
This pillar is locked on this plan
Unlocked on the plan. Everything else on your plan keeps working; nothing here runs or is billed until the plan includes it.
An Owner or Admin can change the plan or ask for a trial from Billing.
Executive overview
Where the money is going ·
Where the money goes: services
Top 5 this month against the same days last month.
Where the money goes: cloud accounts
Top 5 this month against the same days last month.
Unusual spend
The newest open cost anomalies; the full list is under .
Loading anomalies…
Loading…
This month, day by day
Running total so far (solid), the forecast to month end (dashed) with its likely range, and the budget if one is set.
Spend per month by cloud
The last 12 months, AI services included, in the budget's currency.
Loading…
Projects
Budget status uses the month-end forecast, not just spend so far.
Cloud spends
Each connected cloud account: when its costs last synced, when they sync next, and what it spent, in the currency the cloud reports. Costs sync on their own on each account's schedule; no posture scan is needed.
Cost explorer
Every cost in depth, for FinOps and cloud engineering: pick a window and a comparison, filter by account, cloud, service, region or tag, and read each day and each dimension. Amounts stay in the currency each cloud reports; nothing is converted.
Dashboards
Build your own view of cost and cloud posture: pick widgets, cloud accounts and a time range, then save it for yourself or, as an Admin, for the whole organization. Every number is computed by DVSentry when the dashboard opens.
AI spend
What AI is costing: AI services on your cloud bills (Amazon Bedrock, Vertex AI, Gemini API, Azure OpenAI and Azure AI services), and, when your code sends it, the usage of each LLM call by model, feature and customer.
Adding an AI provider, connecting a cloud without a key, or sending token counts from your code? It is all under .
Budgets & alerts
Are we going to stay on budget? Each budget shows spend so far and where the forecast says it will land, in the budget's own currency.
Organization budget
Projects and allocation
Each cost row goes to one project: the most specific rule wins (account and service, then service, then account). Rows no rule matches are Unallocated.
Alerts
Every budget alerts Admins and Owners at 50%, 80% and 100% of its forecast (from the third day reported) and of its actual spend, once per month each, and names the day the forecast expects the budget to be exceeded. A weekly digest arrives on Mondays. Both appear under Alerts, go to the organization's notification channels (email, Slack, webhook) and can be sent to a signed webhook (events cost.budget_threshold and cost.weekly_digest).
Cost anomalies
A day's spend on one service in one account far above its own recent days. Admins and Owners are alerted once per anomaly (event cost.anomaly).
Loading…
Recommendations
Savings suggestions with the evidence behind them, across all clouds.
What insecure and exposed resources cost
Spend is the whole service in the account over 30 days, never one resource: cost rows carry no resource ids.
Loading…
Idle resources
From each account's latest full posture scan; a partially collected resource is never called idle.
Loading…
Rightsizing
Loading…
Savings tracker
Savings your Admins record, from suggested to implemented to measured. Burnwatch never generates one. An estimate is what the Admin entered; a measured saving comes only from synced cost data: the scope's average daily cost before the implementation date against after it, at least 7 reported days each side.
Loading…
Cloud calculator
Describe a workload, compare AWS, Azure and Google Cloud at list prices, then review the estimate breakdown.
Workload details
Provider comparison
Monthly list price in USD for the same hours and quantity. Other clouds show the server's match: the same family, vCPU and memory in the matching region.
Estimate breakdown
Deployment preview
Upload the JSON that terraform show -json plan.out prints (at most 2 MB). Burnwatch prices the instances and disks its catalog has list prices for, as a monthly change, and lists everything else as not priced. The plan is read once and not stored; saving keeps only resource types, address hashes, sizes and the numbers.
Saved previews
AI provider onboarding
Add every AI provider you use, in one place: the steps for each, the keyless commands for your clouds, provider admin keys and the usage helper for your code. Only token counts and the bill are read, never a prompt or a reply.
Connect AI spend: pick the easiest way
- On Amazon Bedrock, Vertex AI, Gemini API or Azure OpenAI? No code change: it is already on your cloud bill. Connect the cloud account without a key (below), turn cost read on for it under , and spend per model shows under after the first sync.
- Want tokens per model the moment each call returns? One line after each call with the DVSentry AI usage helper (OpenAI, Anthropic, Azure OpenAI, Bedrock, Gemini/Vertex, Ollama or any other): only input, cached and output token counts leave your code, never a prompt or a reply. See "Send usage from your code" below.
- Calling OpenAI, Anthropic, Deepgram or ElevenLabs directly? Paste one key under "AI provider keys" below. No code change: Burnwatch reads the provider's own daily usage and bill. It must be an admin or usage key (for example OpenAI Admin keys, Anthropic Admin keys); the key your app calls the model with cannot read the bill. There is no URL to enter: each provider's usage address is fixed.
- Want spend per feature, customer or conversation? Send usage from your code with an ingest token (below). Only this way splits the bill by your own features.
Connect a cloud without a key
For Amazon Bedrock, Azure OpenAI, Vertex AI and the clouds' speech services: run the commands in that cloud's shell, paste what they print on the Cloud page, then turn cost read on under . No key is stored.
AI provider keys
An OpenAI or Anthropic admin key lets Burnwatch read the provider's own daily usage and cost and check it against what your code sends.
Accounts & providers
Every source Burnwatch reads, in one place: connect a cloud account or an AI provider here and see what each one is tracking.
Cloud accounts
Your organization's cloud accounts, the same ones DVSentry Cloud scans. Cost read uses the identity each account connects with; costs sync on their own when you turn it on and then daily (see Cloud spends).
AI providers
AI provider keys, keyless cloud commands and the usage helper are under .
Permissions each cloud needs
Grant these to the identity the account already uses for posture scans. No new credential.
Last 12 months
Monthly totals per provider in the budget's currency.
Tools
Password generator
Make a strong random password or passphrase. It is made in this browser from its secure random source and never leaves it: nothing is sent to DVSentry, stored or logged.
Passphrase words: the BIP-39 English word list (2,048 words, 11 bits each), MIT License, Copyright (c) 2022 Patricio Palladino and Paul Miller (@scure/bip39). The strength shown is the exact size of what an attacker who knows these settings must search.
Tools
Password vault
DVSentry cannot read this. Your entries are encrypted in this browser with a key only your vault passphrase opens. DVSentry stores the encrypted result and cannot read, recover or reset it, and neither can your organization's Admins.
A web page can only be as trustworthy as the code the server sends it. Keep root and production credentials in a password manager with its own app.
Set up your vault
Vaults belong to this organization. If you leave it or are removed, your vaults here are deleted. Export your entries first.
Your recovery key
These 12 words open your vault if you forget your passphrase. They are shown once. Anyone who has them and can sign in as you can read your vault, so keep them as safe as the passphrase.
Unlock your vault
Authenticator codes are made in this browser and show only while DVSentry is reachable. Keep each site's backup codes for when it is not.
Vault state ·
These state words change whenever an entry changes; they are not your key fingerprint (that one never changes and is under Import, export and settings). They are the same on every device while nothing in this vault has changed. They are evidence only when you compare them with another copy, such as your phone or a note you made earlier: this page could show anything.
No entries yet. Add one, or import a CSV file exported from your browser or password manager.
Copy clears the clipboard after 30 seconds while this page stays open. It cannot reach clipboard history (Win+V), clipboard sync or a phone keyboard's clipboard. The vault locks after 15 minutes without use and when you leave the page.
Import, export and settings
Import a CSV file
Export your passwords as CSV from Chrome, Edge, Firefox, Safari, Bitwarden, 1Password or similar. This page reads and encrypts the file; only the encrypted entries are uploaded. Delete the CSV afterwards: it holds your passwords in plain text.
Export
Downloads every entry of this vault as an unencrypted CSV file (Chrome's columns). Anyone with the file can read your passwords: delete it once you have used it.
Vaults
Passphrase and recovery key
Breach checks
Your key fingerprint:
These words stay the same for as long as you keep this vault key, so you can compare them on another device. They are not the vault state words at the top, which change with every edit.
Results
Risk inbox
One prioritised list of what is open in every pillar, with who owns it and how long is left on its remediation target (critical 1 day, high 7, medium 30, low 90). Provider runtime detections from AWS GuardDuty, Microsoft Defender for Cloud and Security Command Center are listed too, linked to the repository whose code runs on the detected resource where verified build provenance shows it. The order here never changes a report score, scorecard or release gate.
Asset owners
An item's owner is its own assignee first, then the owner named here for its asset, then the teams a repository is shared with. A runtime detection on code from a repository takes that repository's owner, otherwise its cloud account's.
DPDP
DPDP and personal data
One place for the personal data work DVSentry can show you: what personal data your code handles, whether it can be deleted, which third parties receive it, what your release gate blocks, and the DPDP evidence pack. It shows what the scans found; it does not decide compliance.
DPDP
Rights requests
Log each request a person makes about their personal data (access, correction, erasure, a grievance, a nominee, withdrawing consent), its due date and, when you close it, what was done and where the evidence is. An erasure request takes the data map's erasure runbook as its checklist. Admins only; the reference, notes and proof are stored encrypted.
DPDP
Personal data breaches
Record a breach, pick what it touched from the data map, and DVSentry runs the notice clocks from the time you became aware and drafts the notices to the Data Protection Board and to the people affected. DVSentry sends nothing: you check each draft and send it yourself. Admins only.
DPDP
Consent evidence
For each kind of personal data whose lawful basis is consent, record the notice or consent form behind it, where it is collected, how a person withdraws it and where the evidence is kept. A data type reviewed as consent with no record here is shown as a gap. Set the lawful basis on the Data map; Admins record consent here.
DPDP
Cross-border view
Every country your personal data is stored in or sent to: cloud data stores by the region your cloud scan recorded, third parties by the country you record for them. Admins review each country outside India.
DPDP
Personal data map
Every kind of personal data your code handles, across all repositories: where it is stored, which third parties receive it, whether it can be erased, and what your team confirmed about why it is kept. It is built from each repository's newest personal data inventory and helps you evidence DPDP work; it does not decide compliance.
Governance
Scorecards
A score out of 1000 for every assessed repository, web target, cloud account, AI target and resilience target, with its history, badges and ranking inside its pillar.
Portfolio
Repositories, cloud accounts and web targets on one page, with cloud drift, resilience and release policies. Built only from recorded results; an asset with no completed report is not counted as clean.
Compliance evidence and Trust Center
Evidence packs, the CERT-In readiness pack and questionnaire drafts, built from what DVSentry recorded for this organization. Supporting evidence only, never a certification. Admins only.
Loading the evidence summary…
Security questionnaire
Paste questions, one per line (up to 300). DVSentry drafts answers from its records; nothing you paste is stored. Read and edit every answer before you send it.
Trust Center
A public page your customers can read. Nothing is public until you publish, and the page shows only the preview below: counts and practices, never a finding, an asset or a member.
Preview of the public page
All pillars
Average score of the assessed assets and the open findings in the newest report of each. A pillar with no completed report is shown as not assessed, never as clean.
Scorecard
Calculated only from recorded facts: the newest completed report, when each issue was first seen, fixed or reopened, and the remediation targets. Nothing is estimated.
Score at each completed report
One point per completed report in the chosen period. Partial and failed reports are left out: what they did not find is not evidence of a fix.
Badges
Each badge is earned from a recorded event and shows the date it happened.
Ranking
Assets are ranked only against assets of the same pillar. An asset with no completed report has no score and is not ranked.
Security report
Findings
No report open
Open a report to review its deduplicated findings, reachability and remediation.