Security & IT Controls on DefectDojo Trust Center

Anti Virus Policy

Thu, 08 Jan 2026 00:00:00 +0000

Definitions

Virus: A program that attaches itself to an executable file or vulnerable application and delivers a payload ranging from annoying to extremely destructive. A file virus executes when an infected file is accessed. A macro virus infects executable code embedded in Microsoft Office programs that allow users to generate macros.
Trojan Horse: Destructive programs, usually viruses or worms, hidden in an attractive or innocent-looking piece of software, such as a game or graphics program. Victims may receive a Trojan horse via email, removable media, or downloads from websites.
Worm: A program that copies itself elsewhere in a computing system, either on the same computer or across networks. Worms may disrupt networks by overloading them. Unlike viruses, worms do not need to attach to files.
Spyware: Programs that install and gather information from a computer without permission, reporting it to the creator or third parties.
Malware: Short for malicious software; programs designed to damage or disrupt a system, including viruses, worms, and Trojan horses.
Adware: Programs installed without user consent or bundled with software to display ads, often causing system slowness or errors.
Keyloggers: Programs that capture keystrokes and may also record screen images, often sending data to a third party.
Ransomware: Malware that restricts user access to systems or files until a ransom is paid.
Server: A computer program that provides services to other programs or devices. A computer running a server program is referred to as a server.
Security Incident: An assessed event of unauthorized entry or attack on an automated information system, including disruption, destruction, or alteration of system functions.
E-mail: Electronic mail, consisting of messages sent over electronic media by a communications application.

Overview

Malware threats must be managed to minimize downtime on DefectDojo, Inc. systems and protect critical systems and member data. This policy is established to:

Cloud and Infrastructure Security Policy

Thu, 08 Jan 2026 00:00:00 +0000

1. Purpose

The purpose of this document is to ensure the security of DefectDojo cloud and infrastructure resources. In addition, it informs all DefectDojo employees and external parties with access to DefectDojo equipment, systems, or networks (DefectDojo Staff) of their obligations with regards to the cloud and infrastructure security of all systems, networks, IT assets, and licensed software, owned, operated, or used by DefectDojo.

Information Security Policy

Thu, 08 Jan 2026 00:00:00 +0000

Purpose

The purpose of this policy is to set out the information security policies that apply to DefectDojo to protect the confidentiality, integrity, and availability of data. Additionally, it informs all DefectDojo employees and external parties with access to DefectDojo equipment, systems, or networks (DefectDojo Staff) of their obligations regarding the Information Security Policy of all systems, networks, IT assets, and licensed software owned, operated, or used by DefectDojo.

Key Management Policy

Thu, 08 Jan 2026 00:00:00 +0000

Purpose

The purpose of this policy is to ensure the proper lifecycle management of encryption keys to protect the confidentiality and integrity of confidential information. Additionally, it informs all DefectDojo employees and external parties with access to DefectDojo equipment, systems, or networks (DefectDojo Staff) of their obligations regarding the management of encryption keys across all systems, networks, IT assets, and licensed software owned, operated, or used by DefectDojo.

Physical and Environmental Security Policy

Thu, 08 Jan 2026 00:00:00 +0000

Purpose

This policy aims to prevent unauthorized physical access, damage, and interference to DefectDojo’s information and information processing facilities. It also informs all DefectDojo employees and external parties with access to DefectDojo equipment, systems, or networks (DefectDojo Staff) of their obligations regarding physical and environmental security.

Vulnerability Management Policy

Thu, 08 Jan 2026 00:00:00 +0000

Purpose

The purpose of this policy is to inform all DefectDojo employees and external parties with access to DefectDojo equipment, systems, or networks (DefectDojo Staff) of their obligations with regards to the Vulnerability Management of all systems, networks, and IT assets for which they are assigned ownership and maintenance.