Trust Center
We practice what we preach. ShieldBase is built with the same security standards we help you achieve.
Certifications & Compliance
How We Protect Your Data
Encryption at Rest & In Transit
All data is encrypted using AES-256 at rest and TLS 1.3 in transit. Database connections use SSL with certificate verification.
EU Data Residency
All data is stored exclusively in EU data centers (Supabase EU region). We never transfer data outside the European Economic Area.
Authentication Security
Bcrypt password hashing, optional TOTP two-factor authentication, session management with automatic expiry, and OAuth 2.0 PKCE flows for Google and Microsoft.
Defensive Row-Level Security
PostgreSQL RLS enabled on all 21 user-data tables, with FORCE RLS on the 5 most sensitive (encryption keys, SSO config, OAuth accounts, verification tokens, SAML assertions). The anonymous role has zero access — organisations can only see their own data.
Comprehensive Audit Trail
Every compliance-related action is logged with before/after snapshots. Full audit trail across 20+ endpoints for evidence collection, with cross-tenant change-log diffs available to platform admins.
Admin Accountability
Every platform-admin action is recorded in an immutable activity log. Impersonation requires explicit start/end with the impersonator stamped on the session. Feature flags are scoped per organisation with rollout percentages.
Production Observability
Sentry release tracking, structured request logging, /health probes for DB and Redis, automated session cleanup, and 7 BullMQ background workers with a live admin queue dashboard.
BYOK Encryption (Business)
Business tier customers can bring their own encryption keys for an additional layer of data protection and control.
API Security
Rate limiting (4 tiers), CSRF protection, XSS sanitization, security headers, and request logging on all API endpoints.
GDPR Compliance
Data minimization, purpose limitation, right to erasure, data portability, and privacy by design throughout the platform.
EU Data Residency in Detail
ShieldBase keeps every byte of customer data inside the European Economic Area. Our default region is Frankfurt (eu-central-1). Backup snapshots and read replicas remain in EU regions only. No customer data is processed in or transferred to non-EU jurisdictions.
- Primary region
- Frankfurt, Germany (eu-central-1)
- Backup region
- Dublin, Ireland (eu-west-1)
- Sub-processors
- Supabase (EU), Vercel (EU edge), Resend (EU), Sentry (EU)
- Cross-border transfers
- None. No Standard Contractual Clauses required.
- AI inference
- Routed via EU-hosted endpoints; prompts and completions are not retained for model training.
- Custom region (Enterprise)
- Single-tenant deployments in a customer-chosen EU region available on request.
Responsible Disclosure
If you discover a security vulnerability, please report it to [email protected]. We take all reports seriously and will respond within 48 hours.