Compliance & Governance on DefectDojo Trust Center

Anti-Corruption & Bribery Policy

Thu, 08 Jan 2026 00:00:00 +0000

1. Purpose

DefectDojo, Inc. is committed to conducting its business ethically and in compliance with all applicable laws and regulations, including the U.S. Foreign Corrupt Practices Act (FCPA), the United Kingdom Bribery Act (UKBA) and similar laws in other countries that prohibit improper payments to obtain a business advantage. This document describes DefectDojo, Inc.’s Policy prohibiting bribery and other improper payments in the conduct of DefectDojo, Inc. business operations and employee responsibilities for ensuring implementation of the Policy. Questions about the Policy or its applicability to particular circumstances should be directed to the Head of HR or Chief Executive Officer.

Audit Policy

Thu, 08 Jan 2026 00:00:00 +0000

1. Purpose

The purpose of this policy is to inform all DefectDojo employees and external parties with access to DefectDojo equipment, systems, or networks (DefectDojo Staff) of their obligations regarding the auditing of all systems, networks, and IT assets for which they are assigned ownership and maintenance.

Completed Fraud Prevention Checklist

Thu, 08 Jan 2026 00:00:00 +0000

Fraud Prevention Checklist

Completed by Jay Paz 02/24/2025

Is ongoing anti-fraud training provided to all employees of the organization?
Do employees understand what constitutes fraud?
- Communicated via policy and during team meetings
Have the costs of fraud to the company and everyone in it – including lost profits, adverse publicity, potential job loss, and decreased morale and productivity – been made clear to employees?
- Communicated via policy and during team meetings
Do employees know where to seek advice when faced with uncertain ethical decisions, and do they believe that they can speak freely?
Has a policy of zero tolerance for fraud been communicated to employees through words and actions?
Is an effective fraud reporting mechanism in place?
Have employees been taught how to communicate concerns about known or potential wrongdoing?
Is there a reporting channel available to employees?
Do employees trust that they can report suspicious activity anonymously and/or confidentially (where legally permissible) and without fear of reprisal?
Has it been made clear to employees that reports of suspicious activity will be promptly and thoroughly evaluated?
Is continuous monitoring software used to detect fraud and, if so, has the use of such software been made known throughout the organization?
Is the management climate/tone at the top one of honesty and integrity?
Are employees surveyed to determine the extent to which they believe management acts with honesty and integrity?
Are performance goals realistic?
Are strong anti-fraud controls in place and operating effectively, including the following?
- Proper segregation of duties
- Use of authorizations
- Physical safeguards
- Job rotations
- Vacations
Does the recruitment policy include the following (where permitted by law)?
- Criminal and civil background checks
- Credit checks
Are employee support programs in place to assist employees struggling with addiction, mental/emotional health, family, or financial problems?
Is an open-door policy in place that allows employees to speak freely about pressures, providing management the opportunity to alleviate such pressures before they become acute?
Are regular, anonymous surveys conducted to assess employee morale?

Exceptions Policy

Thu, 08 Jan 2026 00:00:00 +0000

Purpose

The purpose of this document is to inform all DefectDojo employees and external parties with access to DefectDojo equipment, systems, or networks (DefectDojo Staff) of their obligations regarding requesting exceptions to DefectDojo corporate policies, standards, and procedures.

Fraud Prevention Checklist

Thu, 08 Jan 2026 00:00:00 +0000

Fraud Prevention Checklist

Is ongoing anti-fraud training provided to all employees of the organization?
Do employees understand what constitutes fraud?
Have the costs of fraud to the company and everyone in it – including lost profits, adverse publicity, potential job loss, and decreased morale and productivity – been made clear to employees?
Do employees know where to seek advice when faced with uncertain ethical decisions, and do they believe that they can speak freely?
Has a policy of zero tolerance for fraud been communicated to employees through words and actions?
Is an effective fraud reporting mechanism in place?
Have employees been taught how to communicate concerns about known or potential wrongdoing?
Is there a reporting channel, such as a third-party hotline, available to employees?
Do employees trust that they can report suspicious activity anonymously and/or confidentially (where legally permissible) and without fear of reprisal?
Has it been made clear to employees that reports of suspicious activity will be promptly and thoroughly evaluated?
Do reporting policies and mechanisms extend to vendors, customers, and other outside parties?
To increase employee perception of detection, are the following proactive measures taken and publicized to employees?
Is possible fraudulent conduct actively sought out, rather than dealt with passively?
Does the organization send the message that it actively seeks out fraudulent conduct through fraud assessment questioning by auditors?
Are surprise fraud audits performed in addition to regularly scheduled audits?
Is continuous monitoring software used to detect fraud and, if so, has the use of such software been made known throughout the organization?
Is the management climate/tone at the top one of honesty and integrity?
Are employees surveyed to determine the extent to which they believe management acts with honesty and integrity?
Are performance goals realistic?
Have fraud prevention goals been incorporated into the performance measures that are used to evaluate managers and to determine performance-related compensation?
Has the organization established, implemented, and tested a process for oversight of fraud risks by the Board of Directors or others charged with governance (e.g., the audit committee)?
Are fraud risk assessments performed to proactively identify and mitigate the company’s vulnerabilities to internal and external fraud?
Are strong anti-fraud controls in place and operating effectively, including:
- Proper segregation of duties
- Use of authorizations
- Physical safeguards
- Job rotations
- Vacations
Does the internal audit department, if one exists, have adequate resources and authority to operate effectively and without undue influence from senior management?
Does the recruitment policy include the following (where permitted by law)?
- Criminal and civil background checks
- Credit checks
Are employee support programs in place to assist employees struggling with addiction, mental/emotional health, family, or financial problems?
Is an open-door policy in place that allows employees to speak freely about pressures, providing management the opportunity to alleviate such pressures before they become acute?
Are regular, anonymous surveys conducted to assess employee morale?

Risk Management Policy

Thu, 08 Jan 2026 00:00:00 +0000

Purpose of Policy

This policy informs all DefectDojo employees and external parties with access to DefectDojo equipment, systems, or networks (DefectDojo Staff) of their obligations regarding the risk management of all systems, networks, IT assets, and licensed software, owned, operated, or used by DefectDojo.

Risk Management Procedure

Thu, 08 Jan 2026 00:00:00 +0000

Policy Statement

This procedure supports the DefectDojo Risk Management Policy by providing practical steps for identifying, assessing, treating, monitoring, and reporting risks.