Trust & security
Where Your Data Lives and Who Can Touch It.
Security teams at our defense, finance and public-sector customers ask precise questions. This page answers the common ones: where customer data is stored, who processes it, how long we keep it and how to report a vulnerability to us.
-
Your account
- primary storage US
- EU on request
- regional capacity in Türkiye and Qatar
Sub-processors
-
Google Cloud PlatformPrimary cloud infrastructure
-
Amazon Web ServicesSecondary cloud infrastructure
-
IntercomCustomer support and lead capture
-
SendGridTransactional email delivery
-
CloudflareWebsite hosting, CDN, DNS, edge functions for form processing
Transfers run under SCCs.
What We Store and for How Long.
Customer data is primarily stored in US-based infrastructure. EU-based infrastructure is available on request for EU customers, with regional capacity in Türkiye and Qatar for region-specific deployments.
| What we store | The assets you define and the data the platform discovers while monitoring them, plus configuration, user accounts, audit logs and integration metadata. |
|---|---|
| What we don’t store | Sensitive personal data a customer uploads, unless the customer makes it part of their monitoring scope, such as breached credentials they want watched. |
| Active customer data | The term of the contract, plus 30 days after termination so you can export it. |
| Audit logs | As regulation requires, typically 12 months. |
| Operational logs | 90 days by default. |
| Backups | 90 days. |
| Deletion | Full deletion on request. Longer retention may apply for regulated customers or where the law requires it. |
Personal data rights under GDPR and KVKK, and how to exercise them, are set out in the Privacy Policy.
-
Customer data for the contract term, then
30 days after termination, so you can export it
-
Operational logs
90 days by default
-
Backups
90 days
-
Audit logs
12 months typically, as regulation requires
Full deletion on request. Longer retention may apply for regulated customers or where the law requires it.
Who Processes Data on Our Behalf.
Each is bound by contract to the same data protection obligations we hold ourselves to. We review the list once a year and update it when a sub-processor changes.
| Sub-processor | Purpose | Region |
|---|---|---|
| Google Cloud Platform | Primary cloud infrastructure: compute, storage and networking | US, EU, Qatar |
| Amazon Web Services | Secondary cloud infrastructure | US, Türkiye |
| Intercom | Customer support and lead capture | US |
| SendGrid | Transactional email delivery | US |
| Cloudflare | Website hosting, CDN, DNS and edge functions for form processing | US, global edge |
Every sub-processor transfer runs under Standard Contractual Clauses (SCCs). To subscribe to sub-processor change notifications, email [email protected].
How We Run Our Own Security.
Dogfooding
Our Surface, on Our Platform
Deepinfo’s external attack surface is monitored continuously on the Deepinfo Platform. Every alert type a customer receives, we receive for our own assets.
Access
Least Privilege by Default
Access to customer data is need-to-know and logged. Engineers have no standing production access, and access is granted through audit-trailed mechanisms.
Encryption
Encrypted in Transit and at Rest
TLS with modern ciphers in transit, with legacy protocols switched off. AES-256 at rest, and customer-controlled keys for tenants that require them.
Testing
Tested From Outside and Inside
An annual external penetration test, and continuous internal testing of new and changed code.
The Lines We Draw Around the Index.
The index is built from the open internet: what anyone can reach without an account. We don’t bypass authentication, paywalls or anti-scraping measures.
Where WHOIS data is hidden behind a privacy service or registrar policy, it stays hidden in our data. We don’t broker personal data.
The assets, findings and configuration in a customer account belong to that customer. We don’t surface them to other customers, and we don’t sell them.
Collected from
The open internet
what anyone can reach without an account
-
Not collected
Behind a login
authentication, paywalls and anti-scraping measures are not bypassed
-
Stays hidden
Hidden WHOIS
behind a privacy service or registrar policy
Stay in your account
Your findings
your assets, findings and configuration · not surfaced to other customers · not sold
What Your Vendor Review Will Ask For.
Most security reviews ask for a familiar handful of documents. Here is where each one stands.
| Privacy frameworks | We process personal data under the EU GDPR and Türkiye’s KVKK, with a documented data protection officer function for KVKK. |
|---|---|
| Certifications and audits | Our current certification and audit status is available on request from the security team. |
| Security questionnaires | We complete CAIQ, SIG, VSA or your own format. |
| Data Processing Agreement | Governs the customer data you submit to the platform. Ask us for a copy. |
| Sub-processor list | On this page and in the Privacy Policy, with the transfer mechanism for each. |
Report a Vulnerability in Our Infrastructure.
We welcome reports from security researchers about Deepinfo’s external infrastructure, the platform and our public-facing services. We work in good faith on validation and resolution, and credit researchers in disclosed advisories where appropriate.
Include reproduction steps and any disclosure timeline you have in mind. If the report is sensitive, ask for our PGP key in your first message.
Customer environments, and findings the platform raises about them, are out of scope here. Report those to the customer’s own security team.
| Report to | [email protected] |
|---|---|
| Acknowledgment | We aim for 2 business days. |
| Validation | We aim for 7 business days on routine findings. |
| Public disclosure | 90 days from acknowledgment for routine findings, coordinated with you. Critical findings may move faster. |
| Machine-readable | /.well-known/security.txt |
Questions About Trust & Security
Is there a Data Processing Agreement?
Yes. It governs how Deepinfo processes the personal data in the customer data you submit, and it sets the retention timelines that apply when a contract ends. Ask the security team for a copy.
Which legal entity do we contract with?
Dofo Teknoloji Anonim Şirketi (Dofo Technology Inc.), registered in Türkiye and doing business as Deepinfo. The Terms of Service and the Privacy Policy are issued in its name.
Will monitoring disrupt our systems?
No. Monitoring runs no authenticated scans, no exploit attempts and no load tests, and its port scans and web requests reach only what a host already exposes to the internet.
Can a customer scan infrastructure it doesn’t own?
Not under our terms. The Terms of Service forbid using Deepinfo to scan, probe or monitor infrastructure the customer doesn’t own or isn’t explicitly authorized to assess.
How do we exercise our data protection rights?
Write to [email protected] for access, correction, deletion or any other data subject request. The Privacy Policy also says how to complain to a data protection authority.
We Answer Your Security Review in Writing.
Send your questionnaire, ask for our current certification status or request the Data Processing Agreement. The security team answers directly.