Scanners never hold platform credentials
Enforced in infrastructure and by automated checks on every change.
Confidence starts
with clear information.
Review how SecurityVault handles data, operates the platform and supports your supplier assessment. Find the information your security, legal and procurement teams need.
Signed
Scanner results
Every result is authenticated, signed and replay-protected before it is accepted. Review security controls.
India
Data location
Launch region. US and EU hosting regions are planned in response to demand and are not available yet.
2
Third-party subprocessors
Cloudflare at the network edge and Zoho for transactional email. Everything else is operated by SecurityVault. Review subprocessors.
Yes
DPA available
Incorporated into your agreement, with Standard Contractual Clauses; countersigned copy on request. Read the DPA.
Data handling
What data do we hold, and where?
We hold
Findings and their typed evidence, SBOM components, entity and relationship records, audit events, encrypted integration credentials, user accounts and session metadata.
We do not keep
Repository working copies after the scan environment is removed, or integration credentials in plain text. Findings may retain code excerpts and dataflow evidence. Edge processing and email delivery follow the locations on our subprocessor list.
Location
The hosted service launches in India on infrastructure we operate. US and EU regions are planned in response to customer demand and are not yet available. Discuss residency and deployment requirements with our team before an evaluation.
Third parties
Two, both listed with purpose and region on the subprocessor list. Material changes are announced at least 30 days in advance.
Protection
How is your data protected?
The principles are summarised here; the security overview and the architecture page go further.
Isolation
Every request is bound to your organisation before it touches data, every query is scoped to your tenant, and isolation is tested on every release.
Encryption
Data is encrypted in transit with TLS, both over public networks and between our internal services, and encrypted at rest. Stored integration credentials are encrypted and decrypted only when a scan needs them.
Access control
Single sign-on with your identity provider, MFA and role-based access. Finding dispositions can only be changed by an authenticated person, with a reason code.
AI
AI features run on models hosted in our own infrastructure. Customer content is never sent to a third-party AI provider or used to train models.
Incidents & availability
How will we tell you when something goes wrong?
Live status
The status page checks the website, console and API from your browser and never shows healthy by default.
Incidents
Customers are notified of incidents directly, and we aim to publish a written root-cause analysis within 14 days of every Sev-1 or Sev-2.
Personal-data breaches
Notified to affected customers without undue delay and within 72 hours of confirmation, as set out in the DPA.
Maintenance
We aim to announce planned maintenance at least 7 days ahead, by email.
Assurance
What can your security review see?
Certifications
We hold no third-party certification today; independent audits are planned. Until then we answer from evidence, not badges.
Questionnaires
CAIQ, SIG and custom questionnaires answered on request; our security architecture document is shared under NDA.
Contracts
Terms of service, the Data Processing Addendum and the subprocessor list. The contracting entity is SecurityVault Systems Private Limited, India.
Vulnerabilities
Report to security@securityvault.io. Scope and good-faith terms are in the disclosure policy.
Commitments
Which commitments are enforced in code?
01
02
Every query scoped to your tenant
The tenant comes from the verified session, never from the request; isolation is tested on every release.
03
No machine writes to dispositions
Refused in the application and again in storage. Reason codes are mandatory.
04
Fail closed
A policy error is a deny; an unverified result is rejected.
05
We tell you what is missing
A gap in lineage carries a reason instead of a guessed link.
06
Disclosure honoured
security.txt published; reports acknowledged within two business days.
Who to talk to
Who do you contact?
Security
Privacy
Status
Everything else
Need the details
Ask for the architecture and the DPA.
We share the security architecture document under NDA and answer questionnaires from the same source of truth.