Droidwatch is built so a banking CISO or a DPO can sign off without exception forms. Here is exactly how we isolate analysis, protect data, and prove it.
Every analysis runs in a worker with a restrictive seccomp profile (~120-syscall allowlist), cap_drop ALL and hard CPU/memory limits (RLIMIT_CPU, RLIMIT_AS). An optional gVisor runtime (runsc) adds userspace syscall interposition. No access to private networks, the host, or other tenants.
The static analyzer only reads and decompiles the binary — it is never run. Dynamic analysis (Android only) executes the APK exclusively inside an ephemeral emulator/sandbox, never on the host, and is gated to authenticated users.
Reports can be encrypted with AES-256-GCM (DWE1 envelope). The audit log lives in PostgreSQL behind an append-only immutable trigger — rows cannot be altered or deleted in place.
A Data Processing Addendum (Art. 28) is published, with per-plan retention, disclosed sub-processors, and SCC-based international transfers. Account export and deletion are self-serve.
Run the exact same single image on your own Docker or Kubernetes (Kustomize manifests + optional KEDA autoscaling). Your APKs and reports never leave your perimeter; billing/Stripe webhooks are no-ops on self-host.
Submissions are private by default. If you opt in to the public threat feed, only hashes, domains and IPs are shared — never the binary, never uploader metadata.
The platform-level controls behind every analysis.
kid secret rotation, single-use refresh tokens with server-side revocation, optional TOTP 2FA with backup codes.X-Frame-Options: DENY, X-Content-Type-Options, Referrer-Policy and HSTS (when HTTPS is enabled).runsc) RuntimeClass on Kubernetes.Found a vulnerability? We want to hear from you.
Email [email protected] with details and reproduction steps. We acknowledge reports promptly and will coordinate a fix and disclosure timeline with you. Please do not test against other tenants' data.