DeepSource
By DeepSource Corp.
The typical implementation process for DeepSource software is designed to be quick and seamless, allowing development teams to integrate the platform into their workflows with minimal disruption. Here are the key steps involved:
Sign Up and Integration: The first step is to sign up for a DeepSource account and integrate it with your version control system (VCS) such as GitHub, GitLab, Bitbucket, or Azure DevOps. This integration is straightforward and can be completed in just a few minutes.
Repository Selection: Once integrated, you select the repositories you want to analyze. DeepSource supports both public and private repositories, and you can choose to analyze specific branches or the entire repository.
Configuration: DeepSource provides a configuration file (deepsource.toml) that you can customize to specify the analyzers and rules you want to apply. This file is added to the root of your repository.
Initial Analysis: After configuration, DeepSource performs an initial baseline analysis of your codebase. This analysis identifies existing issues and provides a comprehensive report. The initial analysis typically takes a few minutes, depending on the size of the codebase.
Continuous Analysis: Once the initial analysis is complete, DeepSource continuously analyzes your code with every commit and pull request. This ensures that new issues are detected and addressed promptly, maintaining high code quality and security standards.
Remediation and Autofix: DeepSource provides detailed explanations and remediation suggestions for identified issues. The platform's Autofix™ AI can automatically fix certain types of issues, reducing the manual effort required from developers.
Monitoring and Reporting: DeepSource offers advanced reporting capabilities, allowing you to monitor code quality trends over time and set thresholds for blocking pull requests that do not meet your standards.
The entire implementation process, from sign-up to continuous analysis, can be completed in less than an hour for most teams. The initial setup and configuration are designed to be user-friendly, ensuring that even teams with limited DevSecOps experience can get started quickly.
DeepSource can be customized to fit specific business needs. The platform offers a high degree of flexibility through its configuration file (deepsource.toml), which allows users to tailor the analysis to their specific requirements. This file can be customized to specify which analyzers and rules to apply, enabling teams to focus on the issues most relevant to their projects. Additionally, DeepSource supports custom quality and security gates, allowing organizations to enforce their own standards and block pull requests that do not meet these criteria. The platform also integrates with various tools like Jira, Slack, and Vanta, providing a seamless workflow that can be adapted to different business processes.
DeepSource offers a transparent, seat-based pricing model with several plans to accommodate different needs. Here are the details:
Free Plan: This plan is free and includes unlimited public repositories, one private repository, and limited analysis runs for up to three team members. Community support is provided.
Starter Plan: Priced at $8 per user per month, this plan includes unlimited repositories and analysis runs, with limited usage of Autofix™ and Transformers. Standard support is provided.
Business Plan: At $24 per user per month, this plan includes all Starter features plus unlimited usage of Autofix™ and Transformers, support for monorepos, audit logs, and priority support.
Enterprise Plan: This plan offers custom pricing and includes all Business features plus access to Enterprise Cloud, self-hosted deployment, single sign-on (SSO), priority support with SLA, manual invoicing, and dedicated account management.
There are no additional setup fees mentioned, and maintenance is included in the subscription cost. Support charges vary based on the plan, with higher-tier plans offering priority support and dedicated account management.
DeepSource offers a variety of training and support options to help new users get started and make the most of the platform:
Documentation and Quickstart Guides: DeepSource provides comprehensive documentation and quickstart guides to help users set up and configure the platform quickly. These resources cover everything from initial setup to advanced configuration and usage.
Community Support: For users on the Free and Starter plans, DeepSource offers community support through the DeepSource Discuss forum. This platform allows users to ask questions, share feedback, report bugs, and request features.
Dedicated Support: Users on the Business plan have access to dedicated support through the support portal, where they can raise tickets and receive assistance from the DeepSource team.
Priority Support: Enterprise customers benefit from priority support, which includes faster response times and access to a dedicated support team. Issues can be reported through the support portal or via email.
DeepSource implements several robust security measures to protect user data:
Data Encryption: All data transmitted between users and DeepSource servers is encrypted using industry-standard protocols to ensure data privacy and security.
Access Controls: DeepSource employs strict access controls to ensure that only authorized personnel can access sensitive data. This includes role-based access controls and multi-factor authentication.
Compliance with Security Standards: DeepSource adheres to widely recognized security standards and frameworks, such as OWASP Top 10 and CWE/SANS Top 25, to identify and mitigate security vulnerabilities.
Regular Security Audits: The platform undergoes regular security audits and assessments to identify and address potential vulnerabilities. This helps maintain a high level of security and compliance.
Incident Response: DeepSource has a well-defined incident response plan in place to quickly address and mitigate any security incidents. This includes monitoring for suspicious activity and responding promptly to any detected threats.
Data Privacy: DeepSource is committed to protecting user privacy and complies with relevant data protection regulations. User data is handled with the utmost care and is not shared with third parties without consent.
These measures ensure that DeepSource provides a secure environment for code analysis and development, helping organizations maintain high standards of security and compliance.
DeepSource releases updates regularly to ensure the platform remains secure, efficient, and up-to-date with the latest features. The updates are managed through the DeepSource Admin Console, where users can check for new updates and deploy them as needed. The platform provides a "Version History" tab that shows all available versions, and users can select and deploy the latest version. Some updates are marked as "Required," meaning they must be deployed in sequence before upgrading to the latest version. This structured approach ensures that all necessary updates are applied systematically, maintaining the integrity and functionality of the platform.
DeepSource's policy on data ownership and portability is designed to ensure that users retain control over their data. Here are the key points:
Data Ownership: Users retain ownership of their data, including source code and analysis results. DeepSource does not claim any ownership rights over the user's data.
Data Portability: DeepSource allows users to export their data, ensuring that they can move their data to other platforms if needed. This includes the ability to download analysis results and configuration files.
Data Privacy: DeepSource is committed to protecting user privacy and complies with relevant data protection regulations. User data is handled with care and is not shared with third parties without consent.
Data Security: DeepSource implements robust security measures to protect user data, including encryption, access controls, and regular security audits.
DeepSource offers flexible terms for scaling up or down based on organizational needs. The platform uses a seat-based pricing model, allowing organizations to add or remove users as required. This flexibility ensures that companies can adjust their subscription according to their team size and project requirements without being locked into a fixed number of seats. Additionally, DeepSource's transparent pricing model ensures that costs scale linearly with actual usage, providing financial predictability. Organizations can easily manage their subscription through the DeepSource Admin Console, where they can adjust the number of seats and access additional features as needed.
DeepSource's contract renewal and cancellation terms are outlined in their Master Subscription Agreement (MSA). Here are the key points:
Renewal: Contracts typically renew automatically at the end of the subscription term unless either party provides notice of non-renewal. The renewal term is usually the same length as the initial term unless otherwise agreed upon.
Cancellation: Customers can cancel their subscription by providing written notice to DeepSource before the end of the current subscription term. The cancellation will take effect at the end of the current term, and no refunds are provided for the remaining period.
Termination for Cause: Either party can terminate the agreement for cause if the other party materially breaches the terms and fails to cure the breach within a specified period (usually 30 days) after receiving written notice.
DeepSource meets several key compliance standards to ensure the security and integrity of its platform:
SOC 2 Type II: DeepSource is SOC 2 Type II compliant, which means it adheres to rigorous standards for security, availability, and confidentiality. This compliance is verified through regular independent audits.
OWASP Top 10: The platform provides detailed reports based on the OWASP Top 10 framework, helping organizations identify and mitigate common security vulnerabilities.
CWE/SANS Top 25: DeepSource also aligns with the CWE/SANS Top 25, which lists the most critical software weaknesses.
ISO 27001: DeepSource is working towards obtaining ISO 27001 certification, which is an international standard for information security management.
These compliance standards demonstrate DeepSource's commitment to maintaining high levels of security and data protection, making it a reliable choice for organizations looking to enhance their code quality and security.
