Security frameworks ask you to prove that controls exist and are operating. Maphra and
AppSecD help you generate and report that proof. They are tools you use to meet a requirement —
not certifications DedSec Technologies holds. We are not an auditor and we do not issue certifications; the
mappings below are practical guidance on where our products fit a framework, not legal or audit advice.
SOC 2 — CC6 (access) & CC7 (monitoring)
AppSecD gives a continuous finding lifecycle with a maker-checker trail, so an auditor can
see what was found, who triaged it and when it was resolved — from one dataset, not re-keyed spreadsheets.
Maphra maintains the external asset inventory the control assumes you have; AppSecD
runs the vulnerability process against your code and services and retains the evidence per finding.
AppSecD runs SAST, SCA, secrets and DAST at the pull request and on a schedule; Maphra
continuously maps the externally-reachable surface so nothing in scope is tested only once a year.
Both products produce dated, exportable evidence that safeguards exist and operate, with reachability-weighted
severity so you can show measures are proportionate to real, current risk rather than a static checklist.
Compliance questions, answered honestly
Is DedSec Technologies SOC 2 or ISO 27001 certified?
No. We do not claim certifications of our own. Our products help you produce and report the evidence those frameworks require; certification always rests with you and your assessor. If you ever see our name attached to a certification we claim for ourselves, it did not come from us.
Does AppSecD help with PCI DSS compliance?
Yes. AppSecD runs SAST, SCA, secret detection and DAST at the pull request and on a schedule, which supports PCI DSS v4.0 Requirement 6 (secure software development) and Requirement 11 (regular security testing). It is a tool you use to meet the requirement, not a certification we hold.
What evidence can I export for an audit?
Each finding retains its scan, timestamp and full status history, and status changes go through a maker-checker review. That means you export an auditable record from one dataset rather than reassembling spreadsheets, and an assessor can see what was found, who triaged it and when it was resolved.
How do Maphra and AppSecD map to ISO/IEC 27001?
Maphra maintains the external asset inventory that control A.8.8 (technical vulnerability management) assumes you already have, and AppSecD runs the vulnerability-management process against your code and services while retaining the evidence per finding.
Does using these tools make me compliant on their own?
No. No tool makes an organisation compliant by itself; compliance depends on your controls, your processes and an assessor's judgement. What our products do is give you continuous detection and dated, exportable evidence, which makes demonstrating compliance far less manual.
Can you help with India's DPDP Act or the GDPR?
Both ask for reasonable or appropriate technical safeguards. Maphra and AppSecD produce dated, exportable evidence that safeguards exist and operate, with reachability-weighted severity so you can show the measures are proportionate to real, current risk rather than a static checklist.