Legal
Terms of Service
Effective Date: November 5, 2026 (Version 2026.7)
1. Who we are and accepting these Terms
These Terms are an agreement between [Legal entity name: to be published], [Registered address: to be published], India ("DVSentry", "we", "us"), and the person or organization that creates a DVSentry account or uses the DVSentry service ("you"). By creating an account, ticking the acceptance box, or using the service, you accept these Terms. If you accept them for an organization, you confirm you are authorized to bind it.
DVSentry is a tool for businesses and professionals. You must be at least 18 years old and use it for your trade, business or profession, not as a consumer.
These Terms incorporate the following documents, each published at dvsentry.com/legal: the Acceptable Use Policy, the Privacy Policy, the Data Processing Addendum, the Subscription, Billing and Refund Terms, the DVSentry Software Licence, the Secure Share Terms, the Service Levels and Support statement, the DAST Authorization Agreement and the Data Retention Disclosure. The Early Access Agreement also applies while you use an early access trial, and the Resilience Testing Authorization and the Fix Pull Requests Authorization apply when an administrator accepts them. If they conflict, a signed order form wins, then these Terms, then the incorporated document, except that the Data Processing Addendum wins on personal data.
2. The service
DVSentry is a hosted security platform. Depending on your plan it assesses code repositories, container images, web applications and APIs, internet-facing assets, cloud accounts, Kubernetes clusters and hosts, and AI systems; runs resilience tests on services you nominate; reports on cloud and AI spend ("Burnwatch"); and produces compliance evidence. Parts of it run on your own systems: the DVSentry agent, the command-line client and the IDE extension.
Features, limits and the providers we use may change, and some features are switched off. We tell you in the product when something you use changes.
3. Accounts and security
You must give accurate information, verify your email address, and keep your password, multi-factor authentication, passkeys and personal access tokens secret. You are responsible for what is done through your account and your tokens. Owners and Admins of an organization control its members, roles, integrations and data, and can see what members do in it. Tell us at security@dvsentry.com straight away if you think your account or a token is compromised.
4. What you may test
You may point DVSentry only at repositories, domains, hosts, applications, APIs, cloud accounts, clusters, AI systems and services that you own, or that their owner has authorized you in writing to test. The Acceptable Use Policy and the DAST Authorization Agreement set out the rules.
DVSentry adds its own technical checks: a DNS ownership proof before web and network scans, an Admin attestation for cloud-hosted AI services, a signed authorization, a grant from us and a per-run approval before any resilience test. These checks protect you and others. They do not authorize you to test anything, and they do not move your responsibility for what you test to us.
Resilience (fault-injection) testing is off for every organization until we grant it and an Admin accepts the Resilience Testing Authorization for named targets. You are responsible for the impact of the tests you start, including on availability and cost.
5. Changes to Your Code Only at Your Request
DVSentry does not commit to, push to, alter or refactor your code repositories, except as described in this section. Findings, remediation guidance and downloadable patches are suggestions that your authorized personnel must review, test and apply.
If an administrator of your organization installs the DVSentry Fix GitHub App, accepts the Fix Pull Requests Authorization for a specific repository and adds the DVSentry opt-in file to that repository, DVSentry will, each time an administrator of your DVSentry organization asks it to for a specific finding, create one new branch in that repository and open one pull request that changes the version of one dependency. DVSentry never merges a pull request, never changes or deletes an existing branch, and cannot change workflow files. Creating that branch may automatically start your continuous integration before anyone reviews it. Your administrator can turn this off for any repository at any time.
6. Your Data and the Private Execution Boundary
"Customer Data" means what you or your systems submit to DVSentry, or what DVSentry collects from your systems for you: repository contents during a scan, scan results, findings, evidence, inventories, cost and usage data, configurations, credentials you save, and content you share. You keep all rights in Customer Data. You give us a limited licence to host, copy, process and display it only to provide, secure and support the service for you, and as the law requires.
How we handle source code: to scan a repository we make a temporary copy on DVSentry's servers in India; scanners read that copy in isolated containers without network access, and the copy is deleted when the scan ends. We keep the findings, which can include file paths, line numbers and short excerpts that a scanner reports as evidence, for your organization's retention period. We do not keep your repository and do not send your repositories to AI model providers.
Credentials: a credential you save is encrypted at rest, used only for the purpose you gave it, and can be revoked by you at any time. Where DVSentry offers keyless cloud access, your cloud role trusts DVSentry's own identity issuer and no secret of yours is stored. Agents you install act only within the permissions you grant them.
If Customer Data contains personal data, you are the data fiduciary (controller) for it and we process it for you under the Data Processing Addendum. To count contributing developers for your plan, DVSentry reduces each commit author in the last 90 days of a scanned repository to a salted one-way hash; it never stores their names or email addresses.
We use operational measurements (counts, durations, error rates) to run and improve the service. They never identify you, your users or your assets, and we never use Customer Data to train AI models.
Retention and deletion follow the Privacy Policy and the Data Retention Disclosure.
7. Keyless cloud access and our signing key
Keyless cloud access works because your cloud role trusts tokens signed by DVSentry. We keep that signing key only on the DVSentry services that need it, issue a token only for a scan your organization started (valid for at most one hour and naming only your organization), and publish only the public key. If we have reason to believe the signing key was exposed, we will rotate it and tell every affected organization without undue delay, so you can review your cloud roles. You can remove DVSentry's access at any time by deleting the role or its trust in your cloud account.
8. AI features
Some features use large language models, either from the provider your organization configures with its own key or from a provider DVSentry manages within your plan's allowance. We send them finding details with secrets removed, never your repositories. AI output can be wrong: triage verdicts, explanations and suggestions are advisory, never change a finding, gate or score, and must be checked before you rely on them. Testing your own AI systems sends test prompts to them and records the replies as evidence; you are responsible for the terms of the AI providers whose services you test or whose keys you use.
9. Secure Share
Secure Share messages and files are encrypted in the sender's browser and DVSentry cannot read them. The Secure Share Terms apply.
10. Plans, fees and taxes
Free plans, trials, paid plans, renewals, cancellations and refunds are governed by the Subscription, Billing and Refund Terms. Prices are shown excluding GST, which is added at the applicable rate. Counts of contributing developers and connected cloud accounts above your plan's included amount are shown to you and never block you; we do not charge for them unless we first give you 30 days' notice of the price and you accept it.
11. Our responsibilities
We protect Customer Data with the measures described in the Privacy Policy and the Data Processing Addendum, and we tell you without undue delay of a personal data breach that affects your data. There is no service level commitment unless a signed order form gives one; the Service Levels and Support statement describes what we aim for.
12. Software on your systems
The DVSentry agent, the command-line client, the IDE extension and the helper scripts are licensed to you under the DVSentry Software Licence. Open-source components inside them keep their own licences.
13. Intellectual property and feedback
We own DVSentry, its software, rules, wording, report formats and documentation. You own your Customer Data and the content of your reports as it concerns your systems. If you send us feedback, we may use it without obligation to you. Third-party vulnerability data is used under the licences listed at dvsentry.com/data-sources.
14. Confidentiality
Each party keeps the other's non-public information confidential, uses it only for this agreement and protects it with at least reasonable care. This does not cover information that is or becomes public through no fault of the receiving party, was already known to it, is independently developed, or must be disclosed by law (with notice to the other party where the law allows).
15. Indemnity
You will defend and indemnify DVSentry against third-party claims arising from tests you started against systems you were not authorized to test, Customer Data you had no right to submit, or your breach of the Acceptable Use Policy. We give an intellectual property indemnity only where a signed order form says so.
16. Compliance Evidence vs. Regulatory Certification
Security testing cannot find every vulnerability. DVSentry reports what its scanners and checks observe; the absence of a finding is not proof that a weakness is absent. Compliance mappings, evidence packs, readiness packs and Trust Center pages are technical evidence, not a certification, audit opinion or legal advice. This software does not certify legal compliance. Except as these Terms expressly say, the service is provided "as is" and "as available", and we disclaim implied warranties to the extent the law allows.
17. Limitation of Liability
Neither party is liable for indirect, incidental, special, consequential or punitive damages, or for lost profits, revenue, goodwill or data, arising out of these Terms, even if told they were possible.
Each party's total liability arising out of these Terms in any twelve months is limited to the fees you paid DVSentry in the twelve months before the event giving rise to the claim, or INR 10,000 if you paid nothing.
These limits do not apply to your indemnity, your payment obligations, a party's fraud or wilful misconduct, or liability that the law does not allow to be limited.
18. Suspension and termination
You may stop using the service and delete your organization at any time. We may suspend an organization at once if it breaches the Acceptable Use Policy, stays unpaid after the grace period, or puts the service or others at risk; we tell you why unless the law or an investigation prevents it. We may end these Terms on 30 days' notice, or at once for a material breach. When we close an organization, it is suspended for 60 days, during which an Owner can export reports, and then deleted as the Privacy Policy describes.
19. Changes to these Terms
We may update these Terms. We publish each version here with its number and date and ask you to accept it in the product before you continue; checkout and plan changes wait for that acceptance. For paid plans a material change takes effect 30 days after we notify you, and you may cancel before then.
20. Governing law and disputes
These Terms are governed by the laws of India. The parties will first try to settle a dispute in good faith for 30 days. Any dispute that remains is subject to the exclusive jurisdiction of the courts at [City: to be published], India, except that a customer outside India may instead refer it to arbitration under the Arbitration and Conciliation Act, 1996, by a sole arbitrator, seated at [City: to be published], in English. Either party may seek urgent interim relief from any competent court.
21. Grievance officer and notices
Grievance Officer (Information Technology Act, 2000 and Digital Personal Data Protection Act, 2023): Aslam Jabri, privacy@dvsentry.com. We acknowledge a grievance within 24 hours and resolve it within 15 days.
Legal notices to DVSentry go to privacy@dvsentry.com and to [Registered address: to be published]. Notices to you go to your account email or appear in the product.
22. General
These Terms, the documents they incorporate and any signed order form are the whole agreement between the parties about the service. If a provision is unenforceable, the rest stays in force. You may not assign these Terms without our consent; we may assign them to a successor of the business, with notice to you. Neither party is liable for delay caused by events beyond its reasonable control. Failure to enforce a provision is not a waiver of it.
23. Trade marks
"DVSentry" and the DVSentry mark are used by [Legal entity name: to be published]. Nothing in these Terms gives you a right to use them.