Privacy and data
This page explains how Derbentçi uses account, inventory, finding and notification data.
Account and company information
Account identifiers, email addresses, company memberships and roles are used for sign-in and authorisation. Company operations follow the account's access rights and permissions.
Inventory and security records
Asset names, vendors, products, versions, responsible teams, internet exposure and criticality are used for vulnerability matching and prioritisation. Assignees, due dates, notes, status and remediation evidence added to findings form part of the action history.
Uploaded SBOM documents, component details and version history are stored within the company scope. Relevant package and version details are used in OSV queries.
Notifications and external connections
Notification recipients and selected preferences are used to send relevant emails. Delivery uses the configured email provider, which receives the recipient address and message content. Provider feedback is used to track delivery status.
When Slack, Teams, webhook, Jira or GitHub integrations are configured, selected events and finding details are sent to the relevant system. If Microsoft Graph is connected, the configured company's service status can be queried through that connection.
Sessions and browser storage
The admin panel uses session cookies and browser storage to maintain and refresh sign-in sessions. Session details are managed during sign-in, sign-out and company switching. Clearing browser storage or cookies may require signing in again.
Product screenshots and integration logos on the homepage load from the application's own files. Clicking a source link takes you to the provider's website.
Language preference
Your language choice is stored in a preference cookie and local browser storage. When you sign in to the panel, it is also saved for your user and company account; this record does not change your access permissions.
Homepage analytics
The homepage uses Google Analytics 4 to measure visits and may create analytics cookies. Analytics code does not load in the admin panel or sign-in screen. Account, company, inventory, finding, email address and session key data are not included in analytics events. Homepage query parameters and the referring URL path are not sent; advertising personalisation and Google signals are disabled.
Audit and operational records
Audit records are kept for authorised actions, and operational records track source imports, queues, scans and deliveries. Server and reverse proxy logs are managed by the administrator of the hosting environment.
Deleting company data
An authorised company deletion by the platform owner removes the company's application data and related queue records. Accounts shared across companies and shared CVE/source archives are retained.
Irreversible hashes of provider identifiers are retained to prevent late provider callbacks from recreating deleted delivery records. These hashes contain no recipient address or message content.
Previously sent emails, records exported to external systems and independent server backups are managed separately in their respective systems.
Data and account requests
Contact your company's platform administrator for account, access and data operations relating to your company. For product enquiries, contact [email protected] using this address.