Privacy Policy

ShieldFlow ("ShieldFlow", "we", "us") provides an AI-powered governance, risk and compliance platform. This policy explains what personal data we process and why. For privacy questions, contact privacy@shieldflow.cloud.

To provide and secure the service, generate the compliance features you request, communicate with you about your account, and meet legal obligations. We do not sell your data.

We process data to perform our contract with you, on the basis of our legitimate interests in running and securing the service, and to comply with legal obligations. Where required, we rely on your consent and you may withdraw it at any time.

We use the following vendors to run the service. Each processes data only as needed to provide their service, under a data-processing agreement.

• Supabase — database, authentication and file storage. Hosted in the EU (eu-west-1). This is where your compliance data lives at rest.
• Vercel — application hosting and delivery.
• Groq — AI inference for the Co-Pilot, policy generation and questionnaire drafting. Processed in the United States. We send only aggregate context — control codes and statuses, counts, policy titles — plus the text you type into the Co-Pilot or paste into a questionnaire, from which we automatically strip detectable personal identifiers before it leaves our systems. We never send evidence files, policy contents, personnel records, vendor names or integration credentials. Groq does not train on this data, and we have Zero Data Retention enabled on our account, so inputs and outputs are not stored at all — Groq keeps only usage metadata, which contains no customer data.
• Stripe — payment processing. We never see or store card details.
• Resend — transactional email (sign-in links, notifications).

We keep your data for as long as your account is active. You can delete your workspace data at any time, and we delete or anonymise data within a reasonable period after account closure, except where retention is legally required.

Data is encrypted in transit, access is restricted by row-level security so each company sees only its own data, and secrets are stored server-side. No system is perfectly secure, but we work to protect your information.

Subject to applicable law, you may access, correct, export, or delete your personal data, and object to or restrict certain processing. Contact us to exercise these rights.

Your compliance data is stored in the European Union. The one routine transfer outside the EU is AI inference, which is processed by Groq in the United States — see section 5 for exactly what is sent and what is not. Where data is transferred across borders we rely on appropriate safeguards such as the EU Standard Contractual Clauses. If your obligations require that no data leaves the EU, the AI features can be disabled for your workspace on request; the rest of the product is unaffected.

We may update this policy and will revise the date above. Questions? Email privacy@shieldflow.cloud.