# Trust & Security URL: https://www.deepinfo.com/trust/ ## Where Your Data Lives and Who Can Touch It. Security teams at our defense, finance and public-sector customers ask precise questions. This page answers the common ones: where customer data is stored, who processes it, how long we keep it and how to report a vulnerability to us. [Email the security team](mailto:security@deepinfo.com) · [Privacy policy](https://www.deepinfo.com/privacy/) ### What We Store and for How Long. Customer data is primarily stored in US-based infrastructure. EU-based infrastructure is available on request for EU customers, with regional capacity in Türkiye and Qatar for region-specific deployments. - **What we store**: The assets you define and the data the Deepinfo Platform discovers while monitoring them, plus configuration, user accounts, audit logs and integration metadata. - **What we don’t store**: Sensitive personal data a customer uploads, unless the customer makes it part of their monitoring scope, such as breached credentials they want watched. - **Active customer data**: The term of the contract, plus 30 days after termination so you can export it. - **Audit logs**: As regulation requires, typically 12 months. - **Operational logs**: 90 days by default. - **Backups**: 90 days. - **Deletion**: Full deletion on request. Longer retention may apply for regulated customers or where the law requires it. Personal data rights under GDPR and KVKK, and how to exercise them, are set out in the [Privacy Policy](https://www.deepinfo.com/privacy/). ### Who Processes Data on Our Behalf. Each is bound by contract to the same data protection obligations we hold ourselves to. We review the list once a year and update it when a sub-processor changes. | Sub-processor | Purpose | Region | | --- | --- | --- | | Google Cloud Platform | Primary cloud infrastructure: compute, storage and networking | US, EU, Qatar | | Amazon Web Services | Secondary cloud infrastructure | US, Türkiye | | Intercom | Customer support and lead capture | US | | SendGrid | Transactional email delivery | US | | Cloudflare | Website hosting, CDN, DNS and edge functions for form processing | US, global edge | Every sub-processor transfer runs under Standard Contractual Clauses (SCCs). To subscribe to sub-processor change notifications, email [privacy@deepinfo.com](mailto:privacy@deepinfo.com). ### How We Run Our Own Security. Dogfooding #### Our Surface, on Our Platform Deepinfo’s external attack surface is monitored continuously on the Deepinfo Platform. Every alert type a customer receives, we receive for our own assets. Access #### Least Privilege by Default Access to customer data is need-to-know and logged. Engineers have no standing production access, and access is granted through audit-trailed mechanisms. Encryption #### Encrypted in Transit and at Rest TLS with modern ciphers in transit, with legacy protocols switched off. AES-256 at rest, and customer-controlled keys for tenants that require them. Testing #### Tested From Outside and Inside An annual external penetration test, and continuous internal testing of new and changed code. ### The Lines We Draw Around the Index. The index is built from the open internet: what anyone can reach without an account. We don’t bypass authentication, paywalls or anti-scraping measures. Where WHOIS data is hidden behind a privacy service or registrar policy, it stays hidden in our data. We don’t broker personal data. The assets, findings and configuration in a customer account belong to that customer. We don’t surface them to other customers, and we don’t sell them. [Why we index the internet](https://www.deepinfo.com/blog/why-we-index-the-internet/) ### What Your Vendor Review Will Ask For. Most security reviews ask for a familiar handful of documents. Here is where each one stands. - **Privacy frameworks**: We process personal data under the EU GDPR and Türkiye’s KVKK, with a documented data protection officer function for KVKK. - **Certifications and audits**: Our current certification and audit status is available on request from the security team. - **Security questionnaires**: We complete CAIQ, SIG, VSA or your own format. - **Data Processing Agreement**: Governs the customer data you submit to the platform. Ask us for a copy. - **Sub-processor list**: On this page and in the [Privacy Policy](https://www.deepinfo.com/privacy/), with the transfer mechanism for each. [Request documents](mailto:security@deepinfo.com) ### Report a Vulnerability in Our Infrastructure. We welcome reports from security researchers about Deepinfo’s external infrastructure, the platform and our public-facing services. We work in good faith on validation and resolution, and credit researchers in disclosed advisories where appropriate. Include reproduction steps and any disclosure timeline you have in mind. If the report is sensitive, ask for our PGP key in your first message. Customer environments, and findings the platform raises about them, are out of scope here. Report those to the customer’s own security team. - **Report to**: [security@deepinfo.com](mailto:security@deepinfo.com) - **Acknowledgment**: We aim for 2 business days. - **Validation**: We aim for 7 business days on routine findings. - **Public disclosure**: 90 days from acknowledgment for routine findings, coordinated with you. Critical findings may move faster. - **Machine-readable**: [/.well-known/security.txt](https://www.deepinfo.com/.well-known/security.txt) ### Questions About Trust & Security **Is there a Data Processing Agreement?** Yes. It governs how Deepinfo processes the personal data in the customer data you submit, and it sets the retention timelines that apply when a contract ends. Ask the security team for a copy. **Which legal entity do we contract with?** Dofo Teknoloji Anonim Şirketi (Dofo Technology Inc.), registered in Türkiye and doing business as Deepinfo. The [Terms of Service](https://www.deepinfo.com/terms/) and the [Privacy Policy](https://www.deepinfo.com/privacy/) are issued in its name. **Will monitoring disrupt our systems?** No. Monitoring runs no authenticated scans, no exploit attempts and no load tests, and its port scans and web requests reach only what a host already exposes to the internet. **Can a customer scan infrastructure it doesn’t own?** Not under our terms. The [Terms of Service](https://www.deepinfo.com/terms/#acceptable-use) forbid using Deepinfo to scan, probe or monitor infrastructure the customer doesn’t own or isn’t explicitly authorized to assess. **How do we exercise our data protection rights?** Write to [privacy@deepinfo.com](mailto:privacy@deepinfo.com) for access, correction, deletion or any other data subject request. The [Privacy Policy](https://www.deepinfo.com/privacy/#your-rights) also says how to complain to a data protection authority. ### We Answer Your Security Review in Writing. Send your questionnaire, ask for our current certification status or request the Data Processing Agreement. The security team answers directly. [Email the security team](mailto:security@deepinfo.com) [Contact](https://www.deepinfo.com/contact/)