# DefectDojo Trust Center

We design, develop, and operate DefectDojo with security and privacy embedded at every stage. Our programs are aligned to industry-recognized standards and are continuously improved through testing, monitoring, and independent review.

This Trust Center is kept up to date as our practices evolve. We believe in open communication and providing customers with the information they need to evaluate risk and meet their own compliance obligations.

## Compliance

- **SOC 2 Type 2** System and Organization Controls
- **GDPR** General Data Protection Regulation
- **CRA** EU Cyber Resilience Act

## Policy Documentation

View DefectDojo, Inc.'s current corporate policies on our [Policy Documentation](https://trust.defectdojo.com/policies/intro/about-trust-center/) site.

## Contact Us

For any questions about DefectDojo, Inc. or our policies, please contact us at [hello@defectdojo.com](mailto:hello@defectdojo.com).

## User Documentation

View our user documentation at [docs.defectdojo.com](https://docs.defectdojo.com/).

## Browse policies by category

### Access & Identity Management

- [Access Control Policy](https://trust.defectdojo.com/policies/access_identity/defectdojo-access-control-policy/)
- [API Security Policy](https://trust.defectdojo.com/policies/access_identity/defectdojo-api-security-policy/)
- [Asset Management Policy](https://trust.defectdojo.com/policies/access_identity/defectdojo-asset-management-policy/)
- [Logging and Monitoring Policy](https://trust.defectdojo.com/policies/access_identity/defectdojo-logging-and-monitoring-policy/)
- [Password Policy](https://trust.defectdojo.com/policies/access_identity/defectdojo-password-policy/)

### Business Continuity & Incident Response

- [Business Continuity Policy](https://trust.defectdojo.com/policies/business_continuity_incident_response/defectdojo-business-continuity-policy/)
- [Change Management Policy](https://trust.defectdojo.com/policies/business_continuity_incident_response/defectdojo-change-management-policy/)
- [Incident Management Policy](https://trust.defectdojo.com/policies/business_continuity_incident_response/defectdojo-incident-management-policy/)
- [Pandemic Response Plan](https://trust.defectdojo.com/policies/business_continuity_incident_response/defectdojo-pandemic-response-plan/)

### Compliance & Governance

- [Anti-Corruption & Bribery Policy](https://trust.defectdojo.com/policies/compliance_governance/defectdojo-anti-corruption-bribery-policy/)
- [Audit Policy](https://trust.defectdojo.com/policies/compliance_governance/defectdojo-audit-policy/)
- [Completed Fraud Prevention Checklist](https://trust.defectdojo.com/policies/compliance_governance/defectdojo-completed-fraud-prevention-checklist/)
- [Exceptions Policy](https://trust.defectdojo.com/policies/compliance_governance/defectdojo-exceptions-policy/)
- [Fraud Prevention Checklist](https://trust.defectdojo.com/policies/compliance_governance/defectdojo-fraud-prevention-checklist/)
- [Risk Management Policy](https://trust.defectdojo.com/policies/compliance_governance/defectdojo-risk-management-policy/)
- [Risk Management Procedure](https://trust.defectdojo.com/policies/compliance_governance/defectdojo-risk-management-procedure/)

### Data & Privacy

- [Cryptographic Controls Policy](https://trust.defectdojo.com/policies/data_privacy/defectdojo-cryptographic-controls-policy/)
- [Data Classification Policy](https://trust.defectdojo.com/policies/data_privacy/defectdojo-data-classification-policy/)
- [Data Retention Policy](https://trust.defectdojo.com/policies/data_privacy/defectdojo-data-retention-policy/)

### HR & Employee Policy

- [Background Check Policy](https://trust.defectdojo.com/policies/hr_employees/defectdojo-background-check-policy/)
- [Bring Your Own Device (BYOD), Mobile and Remote Working Policy](https://trust.defectdojo.com/policies/hr_employees/defectdojo-bring-your-own-device-byod-mobile-and-remote-working-policy/)
- [Employee Training and Development Policy](https://trust.defectdojo.com/policies/hr_employees/defectdojo-employee-training-and-development-policy/)

### Security & IT Controls

- [Anti Virus Policy](https://trust.defectdojo.com/policies/security_it_controls/defectdojo-anti-virus-policy/)
- [Cloud and Infrastructure Security Policy](https://trust.defectdojo.com/policies/security_it_controls/defectdojo-cloud-and-infrastructure-security-policy/)
- [Information Security Policy](https://trust.defectdojo.com/policies/security_it_controls/defectdojo-information-security-policy/)
- [Key Management Policy](https://trust.defectdojo.com/policies/security_it_controls/defectdojo-key-management-policy/)
- [Physical and Environmental Security Policy](https://trust.defectdojo.com/policies/security_it_controls/defectdojo-physical-and-environmental-security-policy/)
- [Vulnerability Management Policy](https://trust.defectdojo.com/policies/security_it_controls/defectdojo-vulnerability-management-policy/)

### Vendor & Third-Party Management

- [Vendor Security Policy](https://trust.defectdojo.com/policies/vendor/defectdojo-vendor-security-policy/)

### Corporate Responsibility & Miscellaneous

- [Corporate Climate Policy](https://trust.defectdojo.com/policies/corporate_responsibility/defectdojo-corporate-climate-policy/)
- [Human Rights Policy](https://trust.defectdojo.com/policies/corporate_responsibility/defectdojo-human-rights-policy/)
- [Acceptable Use Policy](https://trust.defectdojo.com/policies/corporate_responsibility/defectdojo-acceptable-use-policy/)