Trust Center
We practice what we preach. ShieldBase is built with the same security standards we help you achieve.
How We Protect Your Data
Encryption at Rest & In Transit
Data is encrypted with AES-256 at rest and with TLS in transit, including the connection between our application and the database.
Primary Data Hosting in the EU
Your database, files and backups are hosted in the EU. Some sub-processors, such as the AI and email providers, are in the US; they are listed in our Privacy Policy.
Authentication Security
Bcrypt password hashing, optional TOTP two-factor authentication, session management with automatic expiry, and OAuth 2.0 PKCE flows for Google and Microsoft.
Defensive Row-Level Security
Tenant isolation is enforced in the application and backed by PostgreSQL row-level security on all user-data tables, with FORCE RLS on the most sensitive ones (encryption keys, SSO configuration, OAuth accounts, verification tokens). The anonymous database role has no access.
Comprehensive Audit Trail
Every compliance-related action is logged with before/after snapshots. Full audit trail across 20+ endpoints for evidence collection, with cross-tenant change-log diffs available to platform admins.
Admin Accountability
Every platform-admin action is recorded in an immutable activity log. Impersonation requires explicit start/end with the impersonator stamped on the session. Feature flags are scoped per organisation with rollout percentages.
Production Observability
Structured request logging and a /health probe for the database.
API Security
Rate limiting (4 tiers), CSRF protection, XSS sanitization, security headers, and request logging on all API endpoints.
Where Your Data Is Processed
The database, file storage and backups are hosted in the EU. The AI providers (Anthropic, OpenAI) and the email provider (Resend) are in the US; transfers to them rely on Standard Contractual Clauses. The full list of sub-processors is in our Privacy Policy.
- Sub-processors
- Supabase, Vercel, Anthropic, OpenAI, Stripe, Resend, Google Analytics (only with consent) — see Privacy Policy
- AI inference
- Processed by Anthropic and OpenAI in the US. Their API terms do not use API data for model training by default.
Responsible Disclosure
If you discover a security vulnerability, please report it to [email protected]. We take all reports seriously.