How Dypzo protects your data.
Dypzo handles business, order and payment records for the businesses that use it. This page describes the controls we run today, and how to tell us about a vulnerability.
What we do to protect data.
These are the measures in place for the Dypzo platform today.
Hosted in India
Dypzo runs on Amazon Web Services in the Mumbai region (ap-south-1). Encrypted backups are copied to the Hyderabad region (ap-south-2).
Encrypted in transit
Traffic between your browser and Dypzo is encrypted with TLS.
Encrypted at rest
Stored data is encrypted at rest, with keys managed in AWS Key Management Service (KMS).
Web application firewall
A web application firewall filters malicious requests before they reach the application.
Multi-factor operator access
Dypzo operators need multi-factor authentication to reach operator tools.
Uploaded documents are scanned
Documents you upload are scanned for malware before they are used.
Passwords screened against breaches
Passwords are checked against known data breaches using a k-anonymity check. Your password is never sent anywhere to do it.
Audit logging
Important actions are recorded in audit logs, so that they can be reviewed later.
Dypzo is newly launched. We describe what we do and do not claim any security certification or audit report. If that changes, we will say so here. For how we handle personal data, see our Privacy Policy.
Keep your account safe.
Keep your sign-in details private, give each team member their own login with only the access they need, and remove people who leave your business. If you think someone else has used your account, tell us straight away.
Responsible disclosure
Found a vulnerability? Tell us.
Please email support@dypzo.com. We read every report and will be in touch about what we find. Dypzo does not run a bug bounty programme and does not pay for reports.
What to include
- What you found and where, with the page or endpoint concerned.
- Steps to reproduce it, or a short proof of concept.
- The impact you think it has.
- How we can reach you.
Please
- Report to us first and give us reasonable time to fix the problem before you share it with anyone else.
- Do not access, change or keep other people's data. Use only your own test accounts and stop as soon as you have shown the issue.
- Do not degrade the service, run denial-of-service tests or use social engineering or physical attacks.
- Do not ask for payment or other conditions in return for a report.
Our contact details for security reports are also published in a standard format at /.well-known/security.txt. For anything that is not a security vulnerability, such as a billing or privacy question, please use the contact page.