Security and assurance
Trust Center
What your vendor risk team can verify about Desprings today, and how to request the rest.
Security overview
What is in place today.
This page lists only practices and credentials that exist now. When a practice is not in place, it is not on this page.
True today
- Access to Desprings systems requires multi-factor authentication and is granted on a least-privilege basis. Access is revoked the same day a team member leaves, and every account is reviewed every six months.
- Client engagement data is stored in the cloud. Each client chooses whether Desprings support can access its data, or whether the data is held outside support view.
- Code changes pass automated tests, type checks, and accessibility gates in continuous integration before merge. Production deployments are manually approved and produce a full audit record.
Compliance register
Certifications and audit reports.
Each entry names its scope, auditor, and dates, and how to obtain the evidence.
No certificates or independent audit reports are listed yet. Each one will appear here with its scope, auditor, and dates when the evidence can be shared. Until then, nothing on this site claims one.
Responsible disclosure
Report a vulnerability.
Reports about this website, or about a system Desprings operates, reach an engineer.
Send reports by email: security@desprings.com
The same address is published in the machine readable format defined by RFC 9116, which security tooling reads automatically.
security.txtThe disclosure policy, linked at the top of this page, sets out the scope and what to include in a report.
Documentation request
Request security documentation.
Tell us what your review needs. An engineer replies within one business day.