Security and Trust

Deepwell connects to systems that hold real client data, for example your PSA, backup, and security tools, so it's fair to ask about that access. This page tells you where things stand today, including what isn't available yet.

How Deepwell keeps your credentials

When you connect a tool, you type its credentials. See Connections and Integrations. Deepwell encrypts them on the way from your browser to Deepwell, and again before it keeps them.

Deepwell only reads from the tools you connect. It does not write to them, and it does not change their settings.

Deepwell never shows these credentials to a Data Source that you build. When you describe an API endpoint, or copy one into the field, authentication isn't part of your input, because your Connection supplies it separately when a Report runs. See Data Sources.

Who can get access to what

Access in Deepwell obeys the roles in Overview and Key Concepts:

• An MSP User can build Reports and read Reports.
• An MSP Admin can also control Connections, credentials, and the access of your team.
• An Organization User is a contact at your client, who can sign in to read the Reports that you deliver to their own Organization and cannot get access to other data in your account.

Analytics and session recording

Deepwell's public website, including these guides, uses analytics and ad-measurement cookies and session recording, but only if you accept the banner on the page. Before you accept, the page sends Google anonymous signals with no cookie and no identifier, so Google can measure its ads in aggregate. Inside the application, Deepwell records which pages signed-in Users open, tagged with the User's account identifier and your MSP's identifier, so it can see which features get used. It does not record sessions there or in your Report portal. On your own custom domain, Deepwell sends no analytics and no session recording. Deepwell's servers still keep the request logs that any web service keeps.

AI training crawlers

Deepwell allows AI training crawlers to read its public website and these guides. Deepwell does not make the application or your Report portal available to AI crawlers, so nothing from your account, and nothing in your clients' Reports, is available to them.

Compliance status

Deepwell does not currently have SOC 2 certification but plans to pursue SOC 2 Type I certification. If you have questions about this or other types of certification please contact us.

Reporting a vulnerability

If you find a security problem in Deepwell, email security@deepwell.software and describe what you found and how to reproduce it. We'll confirm receipt and let you know when the issue is fixed, if verified. Do not test Deepwell's security without written permission from us.

A copy of your data

You can request a copy of your data at any time while your account is active, and for 30 days after it ends. The copy includes:

• The data that Deepwell gets from the systems you connect.
• Your Reports and Report Snapshots.
• Anything else that you or your users put into Deepwell.

We send the copy to you in a standard format. While you can sign in, select Support in the sidebar. After your account ends, use the support form, which doesn't need a sign-in. See How to contact support.

Terms of Service and Privacy Policy

The Terms of Service answer these questions:

• Who owns your data.
• What Deepwell commits to about availability and uptime.
• How you get a copy of your data.

Contact us about a data processing agreement.

The Privacy Policy states what Deepwell collects and which service providers receive it.

Questions without a public answer

This page doesn't answer every question. If your own security review needs an answer that isn't here, contact Deepwell directly. Do not assume an answer. If a process isn't formal yet, Deepwell tells you so.