This page exists so a security or procurement reviewer can answer a vendor-risk questionnaire about DepWarden without having to email us first. Where we do not yet hold a certification or offer a capability, this page says so plainly rather than omitting the question.
The production service runs on Oracle Cloud Infrastructure (OCI) in the Mumbai, India region, on a dedicated compute instance. Application data — accounts, projects, scan results and the vulnerability mirror — is stored on a persistent volume attached to that instance in the same region. Public traffic reaches it through Cloudflare, which provides DNS, TLS termination and DDoS protection.
Data residency: customer data is stored and processed in India today. We do not currently offer an EU or US data-residency option on the hosted service. If your organisation requires one, raise it before purchase — self-hosted and air-gapped deployment exists for exactly this case, and keeps all data inside your own infrastructure.
These third parties may process data on our behalf. We update this list before adding a new subprocessor.
Not subprocessors: we query public vulnerability and package-metadata sources — OSV.dev, NVD, CISA KEV, FIRST EPSS, GitHub Security Advisories, deps.dev and the public package registries. Those lookups carry package coordinates only: never your source code, your identity or your file contents. They receive no personal data, so they are data sources rather than processors.
For customers who need a signed Data Processing Addendum, we provide one covering Article 28(3) processor obligations: processing only on documented instructions, confidentiality commitments, the security measures in section 4, the subprocessor list above with advance notice of changes, assistance with data-subject requests and breach notification, and deletion or return of data at the end of the contract. Standard Contractual Clauses are available where a transfer mechanism is required.
Status, stated plainly: the DPA is provided and signed on request. It is not yet a published, self-serve click-through document. Request it at hello@depwarden.in referencing "DPA".
developer rank on every authentication path, including the session-exchange endpoint — so a leaked key cannot mint further keys, read the audit log, or change workspace settings.Database-level isolation: tenant isolation is enforced today at the application layer — every query is scoped by workspace before it reaches the database, on any of our three supported database drivers (SQLite, MySQL or PostgreSQL). SQLite and MySQL have no database-native row-level security concept to layer on top of that. Self-hosted deployments that select the PostgreSQL driver (DB_DRIVER=postgres) can additionally enable native Postgres Row-Level Security policies on top of the same tenant-scoped queries, for organisations that require enforcement below the application layer as a defence-in-depth measure — this is a deployment-time choice on your own Postgres instance, not something we manage or turn on by default.
We do not hold SOC 2 Type I or Type II, ISO 27001, or any equivalent third-party attestation, and we have not commissioned an independent penetration test. We would rather state that here than have a procurement process discover it late. If a certification is a hard requirement, tell us which one and we will give you an honest answer about timing rather than an aspirational one.
What we can offer instead: a written security-questionnaire response, a walkthrough of the architecture and data flows, and self-hosted or air-gapped deployment so no customer data leaves your infrastructure at all.
DepWarden runs a single-region deployment, and we do not publish a contractual uptime SLA on self-serve plans. Enterprise agreements can include a negotiated availability commitment, a defined support-response target and a maintenance-window policy — contract terms rather than published defaults.
Planned maintenance and availability incidents are communicated to account contacts by email. We do not currently operate a public status page.
DepWarden is operated by a small team, and we treat that as a fair question rather than one to deflect. For organisations where vendor continuity is a material risk, we offer self-hosted deployment and an escrow-style arrangement on Enterprise contracts, so a capability you depend on does not stop working if we do.
Disaster recovery, stated plainly: the hosted service runs in a single OCI region (Mumbai) with no standby region and no automatic failover today. We do not have a formally defined Recovery Time Objective (RTO) or Recovery Point Objective (RPO) to publish yet. Application data is backed up on a regular schedule to storage separate from the live volume; a full-region outage would require manual recovery onto new infrastructure, which we estimate in hours rather than minutes. If your organisation needs a contractual RTO/RPO or a multi-region posture, raise it before purchase — self-hosted deployment puts that entirely in your own infrastructure's hands, including whatever DR posture you already run.
See our Vulnerability Disclosure Policy for scope, safe harbour and our acknowledgement target, or the machine-readable record at /.well-known/security.txt.
A source-code review only means something against the code that is actually running. The exact commit serving this site is published at /api/meta/app under build.commit, so you can confirm that any source you were given matches production instead of taking our word for it.
Security, compliance and DPA requests: hello@depwarden.in. Include your organisation and what you need, and you will get a real answer or a real date.