Security Overview

Version: 1.0
Effective: September 1, 2026

How Dependably protects your data. This document is incorporated by reference into our customer agreements (Master Cloud Service Agreement section 5 and the DPA), so every line here is written to be true today. Each practice is stated as something we have, something we are building, or something planned with no committed date.

It covers Dependably Cloud, the hosted edition of Dependably Packages, and the practices we apply to our own systems and code. The practices marked building below are part of the Dependably Cloud build. Self-hosted deployments of Dependably Packages and Dependably StatusCheck run on your infrastructure under your controls. This overview does not yet cover the hosted plans for Dependably StatusCheck.

Where a customer agreement sets a specific figure (a notice period, a retention period, a response time), the agreement governs and this overview does not restate it.

1. Security program and policies

Have

• A written policy set: information security, access control, change management, incident response, vendor management, risk management, data classification and handling, and application security testing. Available on request.
• Self-assessments of our own build pipeline against NIST SSDF (SP 800-218) and our six-domain AI DevSecOps maturity framework. Both are self-assessments.
• We answer security questionnaires directly: support@dependably.ca.

2. People and endpoints

Have

• Production access is limited to named individuals. Today that is the founder; CI deploys through a scoped identity.
• Our rule is that Customer Content does not sit on developer machines.
• Company endpoints run managed anti-malware protection and endpoint security monitoring that reports to a central console.

Commitments for anyone who later receives production access

• Confidentiality and acceptable-use agreements signed, security awareness training completed, and screening appropriate to the role, before access is granted.
• Access removed at separation.

3. Access control

Building

• Dependably-side: multi-factor authentication on production and administrative accounts, least-privilege roles, and a record of production access.
• Customer-side: multi-factor authentication available to your administrators, and role-based access control inside the Cloud Service.

4. Hosting, data residency, and encryption

Have

• Some of our providers (payments, email, support tooling, error monitoring, and website analytics) operate in the United States. What each receives is described in the Privacy Policy.

Building

• Dependably Cloud will be hosted in AWS Canadian regions by default, with Customer Content and encrypted backups stored in Canada. Customer Content moves outside Canada only at your instruction.
• Compute in private networks behind a managed load balancer, with environments isolated from each other.
• Encryption in transit and at rest using industry standard modern encryption practices.
• Customer signing keys stored encrypted. Private keys used for artefact signing stay under your control.

5. Tenant separation and deployment models

Building

• Multi-tenant Dependably Cloud, the default: logical separation between tenants, enforced in code and covered by tests.

Planned

• Dedicated tenant and deployment in your own cloud account, for Enterprise conversations and scoped per agreement. We will not sign one until the isolation model is built and testable.

6. Logging and monitoring

Building

• Centralized logging of security-relevant events, including production access, protected in transit and at rest, with automated alerting.

7. Secure development and our own supply chain

Have

• We do not use pickle-based model formats (.pkl, .pt) in our build.

Building

• Review before merge on production repositories.
• Third-party dependencies pinned and verified.
• Automated static analysis, dependency, secret, and container scanning in CI, with serious findings blocking a deploy.
• SBOMs, signatures, and build attestations for our own releases.
• Reproducible builds.

8. Third-party management

Have

• A written vendor management policy (section 1).
• Providers that handle personal information do so under contract, as the Privacy Policy describes.

Building

• A published list of sub-processors for Dependably Cloud, with advance notice of changes as the DPA provides.

9. Vulnerability management

Have

• A coordinated vulnerability disclosure program with a safe harbour for good-faith research: dependably.ca/security.

Building

• Scanning of our own code and dependencies in CI (section 7).

10. Business continuity

Building

• Encrypted backups, stored in Canada.
• Restore testing on a schedule.

Planned

• A periodic disaster recovery exercise.

11. Incident response

Have

• A written incident response policy, based on NIST SP 800-61.
• We notify affected customers of confirmed security incidents involving their Customer Content within the period set in the DPA, or sooner where law requires.

Planned

• Incident response tabletop exercises on a running cadence.

12. Privacy and AI

Have

• We are a Canadian company, and Dependably Cloud will default to Canadian hosting. Our Privacy Policy (dependably.ca/privacy) addresses PIPEDA, BC PIPA, GDPR, and Quebec Law 25 rights, and our DPA incorporates the EU Standard Contractual Clauses. We do not sell personal information.
• We do not use Customer Content to train AI models, ours or anyone's. This is a binding DPA commitment (section 3.2); changing it would be a material change requiring customer notice.
• No third-party AI service receives Customer Content.

Evidence available

Public on dependably.ca: privacy policy (/privacy), terms (/terms), cookie policy (/cookies), AUP (/aup), and security policy (/security).

On request via security@dependably.ca: the internal policy set, and the maturity self-assessment of our own systems (under NDA).

Shared responsibility

Questions

Security and evidence: security@dependably.ca · Procurement and questionnaires: support@dependably.ca · Privacy: privacy@dependably.ca · Vulnerability reports: dependably.ca/security.

Dependably Packages and Dependably StatusCheck are products of MoonlitLabs Computing Ltd., a Canadian company.