Security & Trust Hub

Every repository is continuously scanned for vulnerable dependencies and leaked secrets with Trivy (open source) in our CI pipeline. As of 2026-07-13: 0 critical, 0 high and 0 medium open findings.

• Dependency (SCA) and secret scanning on every pull request and daily
• Mandatory code review, linting, type-checking and automated tests before merge
• Security headers on every response: HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and CSP

No security incidents have been reported to date (last reviewed 2026-07-13).

Our services are monitored around the clock by an independent, external provider. See live status and history on our public status page.

• All traffic encrypted in transit with TLS 1.2+ and HSTS
• Sensitive OAuth tokens (Microsoft Entra ID) encrypted at rest with AES-256-GCM
• Strict multi-tenant isolation — every data query is scoped to your organization
• JWT-based authentication with an enforced password policy

All service data is stored in the European Union — Microsoft Azure, West Europe region (Netherlands).

• Self-service data export and account deletion (with a 30-day grace period)
• Right to restrict processing, honoured across all data endpoints
• Full audit log of account and data activity
• Data Processing Agreement (DPA) available on request
• Cookie consent managed via Cookiebot

See our Privacy Policy for full detail.

Verify our public configuration for yourself:

• TLS / SSL grade (Qualys SSL Labs)
• HTTP security headers (Mozilla Observatory)

Found a security issue? We appreciate responsible disclosure. Email security@shieldshed.com — see our security.txt. We aim to acknowledge reports promptly.