Privacy Policy

DesSecurity runs Dependency Map, a service that scans code repositories for vulnerable dependencies and leaked secrets. Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), we are the Data Fiduciary for the personal data described here.

• Legal entity: DesSecurity
• Address: Gadson House, 1st Floor, Plot 9, Rd 2, Sector-19, New Panvel, Navi Mumbai, MH, 410206
• Privacy and grievance contact: Kshitija Kulkarni, kshitija.k@des-security.com
• Effective date: October 11, 2026

We process your data with your consent, which you give when you create an account, and each time you start a scan. You can withdraw consent at any time by closing your account; this does not affect processing already done.

This policy covers the DesSecurity website and the Dependency Map service, including the dashboard, reports, and exports. It does not cover third-party sites or services we link to, such as GitHub, or your AI provider; their own policies apply.

The following terms have the meanings given to them in the Digital Personal Data Protection Act, 2023 ("DPDP Act"):

Personal dataSection 2(t)

Any data about an individual who is identifiable by or in relation to such data.

In practice, this includes your name, email address, GitHub username, account details, IP address and other information that can identify you.

Digital personal dataSection 2(n)

Personal data in digital form.

The DPDP Act applies to personal data collected in digital form, or collected offline and later digitized.

Data Principal (“you”)Section 2(j)

The individual to whom the personal data relates. Where that individual is:

• (i) a child, it includes the parents or lawful guardian of the child; and
• (ii) a person with disability, it includes their lawful guardian acting on their behalf.

Account

The account you create to access the Service.

Repository Data

Source code, dependency manifests (such as requirements.txt, package.json and pom.xml) and related files that the Service retrieves from a GitHub repository you submit, solely to perform the analysis you request.

Access Token

A GitHub Personal Access Token or similar credential you provide, so the Service can read private repositories on your behalf.

Analysis Results

The outputs the Service generates from Repository Data, such as dependency graphs, component inventories and vulnerability (CVE) reports.

Usage Data

Information collected automatically when you use the Service, such as IP address, browser type, pages visited, timestamps and error logs.

Cookies

Small files stored on your device that help the Service function, remember preferences or measure usage.

Third-Party Services

External services the Service relies on, such as GitHub, public vulnerability databases, cloud hosting providers and payment processors.

Grievance Officer

The person designated by us to respond to your questions and grievances about the processing of your personal data, as required under Section 8(10) of the DPDP Act.

Data Fiduciary (“we”, “us”, “our”)Section 2(i)

Any person who, alone or together with other persons, determines the purpose and means of processing of personal data.

DesSecurity is the Data Fiduciary for personal data processed through Dependency Map.

Data ProcessorSection 2(k)

Any person who processes personal data on behalf of a Data Fiduciary.

Examples include our hosting, cloud infrastructure, email, and payment service providers.

ProcessingSection 2(x)

A wholly or partly automated operation, or set of operations, performed on digital personal data. It includes collection, recording, organization, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or making available, restriction, erasure or destruction.

ConsentSection 6(1)

Consent given by the Data Principal that is free, specific, informed, unconditional and unambiguous, given through a clear affirmative action. It signifies agreement to the processing of personal data for a specified purpose and is limited to the personal data necessary for that purpose. You may withdraw consent at any time, and withdrawing it should be as easy as giving it (Section 6(4)).

We collect only what we need to run scans and show you the results.

Please note that the categories and examples provided in the list below are defined in the DPDP Act. This does not mean that all examples of that category of personal information were in fact collected by us, but reflects our good faith belief, to the best of our knowledge, that some of that information from the applicable category may be and may have been collected.

We do not sell or rent your data, use it for advertising, or use your code or scan results to train AI models.

We use personal data only for the purposes in the table above. Before using it for any new purpose, we will ask for your consent again.

Without separate consent, we may process personal data only for the legitimate uses the DPDP Act allows, such as meeting a legal obligation or complying with a court order or a lawful request from a government authority. We keep security logs on this basis.

We collect the minimum each feature needs. Risk scores rate your code dependencies, not you, and we make no automated decisions about you as a person.

Every connection that carries your data is encrypted with TLS 1.2 or higher. Plain, unencrypted connections are refused or redirected.

Your GitHub token and AI key are only ever sent between our servers and the service they belong to. They are never sent to your browser.

Every request to our API that reads or changes your data must carry a valid, signed sign-in token. Saved scans are returned only to the account that ran them.

All stored data is encrypted, and each store is limited to the data it needs.

Our application connects to the database with restricted accounts. They can read and write the application's own tables but cannot change or drop the database structure.

We also limit who can access personal data, keep logs that let us detect and investigate unauthorized access, and keep encrypted backups so data can be restored after an incident.

No system is completely secure. We review these safeguards regularly, but we cannot promise that data will never be accessed without permission. If it is, the breach section below explains what we will do.

• Your source code. It is deleted at the end of every scan. We keep only the results described above, such as file paths and package names.
• Your password. Clerk handles sign-in; it never reaches our servers.
• The full value of a secret we find. We keep a masked preview (at most the first 4 characters) and a keyed fingerprint, so the same secret can be recognized across scans without being stored.
• Your GitHub token. We fetch it from Clerk for each scan and discard it afterwards.
• Your AI key in readable form. It is stored encrypted.

Repositories can contain other people's personal data, such as names or email addresses in code or configuration files. When you scan a repository, you confirm that you have the right to let us analyze it.

We read such data only to produce your scan, keep only the results described above, and never store the full value of any secret. If your results include someone else's personal data, you can ask us to delete those results.

We share data only with the services below, only what each one needs, and always over encrypted connections.

We disclose data to authorities only when Indian law requires it.

Our service providers act as our Data Processors. Each processes personal data only on our instructions, under a written agreement that requires it to keep the data secure and to delete or return it when the service ends.

If DesSecurity is merged, acquired or sells its assets, personal data may pass to the new owner, who must keep protecting it under this policy. We will email you before that happens.

To delete scan results or your whole account, email kshitija.k@des-security.com from your account's email address.

In the absence of any communication or active requests from you regarding your account or analysis outputs, any stored scan results and secret-scan results will be retained for a maximum period of one (1) year before being permanently erased from our system.

Under the DPDP Act you can:

• Get a summary of the personal data we hold about you, how we use it, and who we have shared it with.
• Correct or update data that is wrong or incomplete.
• Erase your data, unless the law requires us to keep it.
• Withdraw consent at any time by closing your account.
• Nominate someone to use these rights for you if you die or become unable to.
• Raise a grievance with us, and then complain to the Data Protection Board of India if you are not satisfied.

To use any of these rights, email kshitija.k@des-security.com from your account's email address. We reply within 30 days, and never later than the 90 days the DPDP Rules allow.

The DPDP Act also gives you duties as a Data Principal. When you use DesSecurity or contact us about your data, you must:

• Follow the law;
• Not impersonate anyone else;
• Not hide important information when you give us personal data;
• Not file false or frivolous complaints;
• Give accurate, verifiable information when you ask us to correct your data.

If a breach affects your personal data, we will email you without delay. The email will say what happened, what it means to you, and what we are doing about it. We will also report the breach to the Data Protection Board of India: a first notice without delay and a full report within 72 hours, as the DPDP Rules require.

Cookies and browser storage. We use only the cookies needed to keep you signed in, set by Clerk. There are no advertising or analytics cookies. While a tab is open, the app keeps temporary data in your browser session storage: your latest scan, your repository list, and AI suggestions. It is cleared when you close the tab.

Children. DesSecurity is for professional use and is not available to anyone under 18. If you believe a child has signed up, contact us and we will delete the account.

Transfers outside India. Clerk stores account data in the USA. Our database is hosted in US-east-2 (Ohio). The DPDP Act allows these transfers unless the Government restricts a country; if that happens, we will stop or move the transfer.

Changes to this policy. We will post changes on this page with a new effective date. For important changes, we will email you before they take effect.

Language. This policy is written in English. You can ask for it in any language listed in the Eighth Schedule to the Constitution of India by emailing kshitija.k@des-security.com.

Governing law. This policy is governed by the laws of India. The courts in Mumbai have jurisdiction over any dispute about it. This does not limit your right to complain to the Data Protection Board of India.

If you have any questions about this Privacy Policy, you can contact us by email at kshitija.k@des-security.com.