Your scanner reports describe your weak spots. We treat them that way.
The questions security teams ask us first, answered with what Dvaro does today. Where something is planned and not built, this page says so.
Your questions
- Where does our data go?Into your own workspace. Every query is scoped to it, so one client never sees another's findings.
- Where does Dvaro run?In Umaadi's cloud. Nothing is installed on your laptops or on your own servers. Umaadi sets up your workspace, and your findings reach it in one of three ways: connect your scanners, upload the reports they produce, or add one call to your CI (continuous integration) pipeline that returns pass or fail.
- Does AI read our reports?A local model, by default. A cloud model only if your admin picks it and your people consent. You can switch AI off. And the question-answering assistant cannot change anything.
- Can we leave?Any time. Export your findings as CSV or JSON. Evidence packs export as JSON or a printable page.
- Who helps us?Umaadi's own security practitioners, with a review call at the end of the pilot.
- Does Dvaro guess?No. If Dvaro cannot account for a finding, the decision stays Incomplete instead of guessing.
AI explains. Inside a decision it never lifts a hold.
The assistant that answers your questions works only from what Dvaro stored about your workspace, and it cannot change a finding, a rule or a decision. Inside a decision, AI can raise a severity or add a reason to hold. It can never lower a severity or lift a hold. Where no rule matched, a labelled AI assessment can stand in for one. Every AI input is labelled.
- Local by defaultAI runs on a local model unless your admin chooses otherwise.
- Cloud only with consentA cloud model is used only if your admin picks one and your own people consent to it.
- Off is an optionSwitch AI off and Dvaro makes no AI call at all. Rules and decisions still run without it.
- Rules stay humanAI may draft a detection rule. Only people can approve and publish one.
A paid pilot, credited to your first year, or your money back.
30 days on your own scanner reports. Before it starts we agree with you what results it must show, and at the end we measure them together on a review call.
- If you continueThe pilot fee is credited in full to your first year.
- If it falls shortIf the agreed results aren't met, you get your money back.
- Not refundedThe cloud running costs of the pilot are not refunded.
- After the pilotA subscription per workspace, per year, quoted after the pilot.
Who can do what, and the record of it
- Sign-inPassword plus a one-time code from an authenticator app (TOTP). Single sign-on is planned.
- RolesCISO (Chief Information Security Officer), Team lead, Developer, Analyst and Viewer, each with its own rights.
- Audit trailAppend-only. The database itself refuses edits and deletions of the record.
- Evidence packsEach decision carries its findings, rules and policy, hashed with SHA-256 (Secure Hash Algorithm) so any later change shows, and the sign-off when someone signs it.
- Rule changesNobody approves their own rule. A reviewer approves it and a different person makes it live.
- Encrypted archivesArchived data is encrypted with AES-256-GCM (Advanced Encryption Standard). The key is split into five shares, and any three of them are needed to restore it.
- Outbound callsDvaro looks up public vulnerability data (EPSS, the CISA KEV catalogue and NVD). It can instead read a local copy of those feeds, so processing a report makes no live lookups.
The essentials of this page, in one PDF.
A two-page overview to attach to your vendor questionnaire. It says what Dvaro does with your data today, and what is planned and not built.
No flat 100% claim.
We do not claim Dvaro is 100% accurate. Once it is measured on labelled real-world reports, we will publish how often Dvaro's rules are right for each scanner, with its margin of error.
Today it is measured only on test data, so we quote no number.
None yet, and we will not pretend.
Dvaro holds no ISO 27001 certificate or SOC 2 (System and Organization Controls 2) report today. When an independent auditor issues one, it will be listed here with its date. An external penetration test of Dvaro is planned before it processes client data.
Tell us first.
Write to [email protected] with the steps to reproduce it. Please ask us in writing before you test Dvaro itself.
Ask us the hard questions before you send a report.
Where something is planned and not built, we will tell you so on the call too.
Book a pilot