Droidwatch is built so a banking CISO or a DPO can sign off without exception forms. Here is exactly how we isolate analysis, protect data, and prove it.
Every analysis runs in a worker with a restrictive seccomp profile (~120-syscall allowlist), cap_drop ALL and hard CPU/memory limits (RLIMIT_CPU, RLIMIT_AS). An optional gVisor runtime (runsc) adds userspace syscall interposition. No access to private networks, the host, or other tenants.
The static analyzer only reads and decompiles the binary — it is never run. Dynamic analysis (Android only) executes the APK exclusively inside an ephemeral emulator/sandbox, never on the host, and is gated to authenticated users.
Reports can be encrypted with AES-256-GCM (DWE1 envelope). The audit log lives in PostgreSQL behind an append-only immutable trigger — rows cannot be altered or deleted in place.
A Data Processing Addendum (Art. 28) is published, with per-plan retention, disclosed sub-processors, and SCC-based international transfers. Account export and deletion are self-serve.
We never share submitted files with anyone. Only de-identified IOCs — hashes, domains, IPs — reach the optional public threat feed, and you can opt out per upload. Files can be encrypted at rest with AES-256-GCM.
Submissions are private by default. If you opt in to the public threat feed, only hashes, domains and IPs are shared — never the binary, never uploader metadata.
The platform-level controls behind every analysis.
kid secret rotation, single-use refresh tokens with server-side revocation, optional TOTP 2FA with backup codes.X-Frame-Options: DENY, X-Content-Type-Options, Referrer-Policy and HSTS (when HTTPS is enabled).runsc) RuntimeClass on Kubernetes.Found a vulnerability? We want to hear from you.
Email [email protected] with details and reproduction steps. We acknowledge reports promptly and will coordinate a fix and disclosure timeline with you. Please do not test against other tenants' data.