DeepSource

DeepSource's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Security isn't a single yes/no, but DeepSource is SOC 2 Type II compliant and holds SOC 2 Type II, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

DeepSource hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@deepsource.com or via a /security page (DeepSource lists a security contact).

DeepSource lists 6 subprocessors on its trust center, including Stripe, Zendesk, Cloudflare, Google Cloud Platform, Sentry. Buyers use this for fourth-party risk review.

DeepSource hosts on GCP. Data residency details are on its trust center.

DeepSource's trust center is at https://trust.deepsource.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

DeepSource takes the security of its systems and its data very seriously. We continuously strive to maintain and ensure that our environment is safe and secure for everyone to use. We understand the effort that goes into security research. To show our appreciation to researchers, who help keep our products and our customer's data safe, we are glad to introduce a Responsible Disclosure Program to provide recognition and rewards for responsibly disclosed vulnerabilities. If a researcher follows the rules set out in this Responsible Disclosure Policy when reporting a security vulnerability to us, we commit to the following: - Acknowledge receipt of the vulnerability report and work with the security researcher to quickly understand and resolve the issue. - Validate, respond, and fix such vulnerabilities in accordance with our security and privacy commitments. We will notify you when the issue is resolved. - Pay a bug bounty in accordance with our bounty rates. ### Response Time DeepSource will make its best effort to meet the following response targets for security researchers participating in our program. ### Bug Bounty Program rules - A Researcher can test only against an account if they are an account owner or agent authorized by the account owner to conduct such testing. - If you accidentally access any of our customer data or any other sensitive data, please stop testing and submit the vulnerability. - Stop testing and report the issue immediately to security@deepsource.io if you gain access to any non-public application or non-public credentials. - Do not degrade the user experience, disrupt production systems, or destroy data during security testing. The following test types are expressly excluded from scope and testing: any findings from physical testing (office access, tailgating, open doors) or DoS or DDoS attack. A responsible disclosure also does not include identifying spelling mistakes or UI and UX bugs. - Do not use scanners or automated tools to find…

- DeepSource Cloud (deepsource.com) servers are located in the United States. - DeepSource Server is self-hosted in customer's premises and can be deployed to region of the customer's choice.

All our repository operations and analysis runs are executed in a secure sandbox. Each sandbox is restricted to access data only within its scope, and it is not possible to access a sandbox from another sandbox, or from the Internet. Each analysis run starts in a fresh sandbox, and each sandbox is destroyed after each run, preventing leaking any user-specific information or source code from inside the runtime to other sandboxes or a public network. ‍We use OAuth tokens as our authentication mechanism to access source code from the supported source code hosting providers. When you start using DeepSource, you have to explicitly grant permissions in the respective source code hosting provider that you are authorizing us to check out your public and private repositories. To analyze the source code, we check out your code from supported source code hosting providers. DeepSource does not store your source code. As soon as the analysis transaction is complete, the source code is purged within our infrastructure and are not backed up.