Trust
Security at Shieldra
Security practices for protecting AI governance and compliance data, customer documents, and platform access — encryption, access control, infrastructure, monitoring, incident response, and vulnerability management, plus our honest compliance posture.
By the Shieldra Compliance Team · Last updated July 2026
Key takeaways
- AES-256 encryption at rest and TLS in transit, with sensitive secrets additionally encrypted at the application layer.
- RBAC on least privilege, MFA with tenant-wide enforcement options, and SSO available on Enterprise.
- Hosted on cloud infrastructure providers that maintain SOC 2 Type II attestations, with logically isolated tenant environments.
- Recurring security reviews, a responsible disclosure channel, and prioritized patching of critical vulnerabilities.
- Breach notification without undue delay and within 72 hours per our DPA.
Encryption
AES-256 encryption at rest for all stored data and TLS encryption in transit for all communications. Sensitive secrets are additionally encrypted at the application layer.
Access control
Role-based access control on the principle of least privilege, with multi-factor authentication supported and tenant-wide enforcement options, and least-privilege role assignments across your workspace. Single sign-on is available on Enterprise plans.
Infrastructure
The platform is hosted on cloud infrastructure providers that maintain SOC 2 Type II attestations, with logically isolated tenant environments, managed platform patching and hardening, and managed, replicated database infrastructure.
Monitoring and logging
- Continuous automated monitoring with alerting
- Comprehensive audit logging of all system and user activity
- Centralized log management with tamper-evident records
Incident response
- Defined incident response and escalation procedures aligned with NIST SP 800-61
- Customer notification of personal-data breaches without undue delay — and within 72 hours under our DPA
- Post-incident reviews with documented lessons learned
Vulnerability management
- Recurring security reviews of the codebase and infrastructure
- A responsible disclosure channel for security researchers
- Prioritized patching of critical vulnerabilities
Compliance posture
Stated honestly: "Self-Attested" means we have mapped our controls to the framework without a third-party audit; "In Progress" means we are actively working toward external certification. HIPAA: Self-Attested. SOC 2 Type II: In Progress. HITRUST CSF: In Progress. NIST CSF: Self-Attested. ISO 27001: In Progress. GDPR: Self-Attested. See the Trust Center for details.
Frequently asked questions
How is customer data encrypted?
All stored data is encrypted at rest with AES-256, and all communications are encrypted in transit with TLS. Sensitive secrets are additionally encrypted at the application layer.
Does Shieldra support SSO and MFA?
Multi-factor authentication is supported with tenant-wide enforcement options, alongside role-based access control on the principle of least privilege. Single sign-on is available on Enterprise plans.
How do I report a security vulnerability?
Shieldra welcomes responsible disclosure. Report vulnerabilities to security@shieldra.ai; critical vulnerabilities are prioritized for patching.
Is Shieldra SOC 2 certified?
Shieldra’s own SOC 2 Type II report is in progress, not yet issued — as are HITRUST CSF and ISO 27001, while HIPAA, NIST CSF, and GDPR are self-attested. The platform is hosted on cloud infrastructure providers that maintain their own SOC 2 Type II attestations.
