Governance, compliance and identity
Most of this page needs the Governance plan or above (see Billing and plans). The audit log itself, policies and exceptions are on every plan.
Scorecards, trends and portfolio
- Scorecards grade every assessed asset of every pillar from recorded facts: the newest completed report, open issues against their remediation SLA, and fix times (first seen, fixed, reopened). An asset with no completed report has no score. A leaderboard ranks teams and assets.
- Trends shows the same over time, per pillar.
- Portfolio summarises scorecards and posture for leadership; download as PDF or Word.
Dashboard views are cached briefly; each page says "Updated N min ago" with a Refresh button.
Compliance evidence packs
Admins build packs for SOC 2, ISO 27001 and India's DPDP Act, plus a CERT-In 6-hour incident readiness pack, from what DVSentry recorded: reports (through the compliance crosswalk), members and MFA, the audit log, schedules, policies and resilience runs. Each control is marked:
| Status | Meaning |
|---|---|
| Evidence recorded | DVSentry holds evidence for it |
| Needs attention | Evidence shows a gap |
| Nothing recorded | No evidence in DVSentry |
| Your process | Outside what DVSentry can see (training, HR...) |
DVSentry never marks a control "met" and does not certify compliance. Download as PDF, Word or Ed25519-signed JSON. The DPDP and CERT-In wording still awaits a legal review. The DPDP pack reads the personal data map: see DPDP and personal data.
Security questionnaires: paste a customer's questionnaire and get draft answers from your recorded evidence. Nothing is stored.
Trust Center
Publish a public security page at /trust-center/public/<your-slug>. It shows only aggregates (assessment coverage, MFA, scan cadence, your security contact), never a finding, asset or member. Nothing is public until an Admin publishes it from a signed-in browser (never a token); the page is a frozen snapshot; unpublishing removes it at once.
Audit log
Every sensitive action is recorded in the organization's audit log (Organization → Audit log). It is append-only in the database and sealed into a hash chain.
- Export (Admin, where available):
jsonlorcsv, only sealed rows, as one unbroken chain stretch with the chain head. Verify it yourself without trusting DVSentry:python3 scripts/verify_audit_export.py audit-export.jsonl - Streams (where available): Splunk HEC, Amazon S3, or a signed webhook subscription for
audit.*events.
Single sign-on and provisioning
All three are available on request during the beta; set-up is Owner-only with MFA step-up.
| Feature | What it does |
|---|---|
| OIDC SSO | Google Workspace, Microsoft Entra ID (one tenant) or Okta. Code flow with PKCE and nonce; the ID token is verified locally. Email domains are proven with the DNS TXT record. With enforcement on, members other than Owners must sign in through SSO |
| SAML 2.0 | One IdP per organization, SP-initiated, signed responses only; same domain and enforcement rules as OIDC |
| SCIM 2.0 | /scim/v2 with a per-organization dvs_scim_ token (shown once). Provisions only verified-domain addresses as Viewer or Member, maps a group onto one team, never touches Admin or Owner rights; its own IP allow-list |
Example IdP settings for OIDC: redirect URI https://<your DVSentry host>/auth/sso/callback, scopes openid email profile. The settings page shows the exact values for your organization.
The Creator (platform owner) account never signs in through SSO.
Service accounts and token controls
See API, tokens and service accounts: service accounts for CI, fine-grained token scopes and the organization's token IP allow-list.
Something missing or unclear? Tell us with Feedback in the app.