Privacy Policy

Shieldoq ("we," "us," or "our") provides a compliance automation platform that connects to your source control, cloud, and identity systems to map security findings to framework controls.

This policy describes how we handle personal data for account holders, invited team members, and visitors to our marketing site. It applies to data processed through app.shieldoq.com and related services.

• Account data: name, work email, company name, role, and authentication identifiers when you sign up or are invited.
• Integration metadata: repository names, cloud account IDs, configuration snapshots, scan results, and evidence artifacts needed for compliance posture—not your application source code stored long-term unless you enable features that require it.
• Usage data: product interactions, audit logs, IP address, browser type, and timestamps for security and reliability.
• Communications: support requests, questionnaire uploads, and feedback you send us.

• Provide, operate, and improve the compliance platform
• Run automated scans and map findings to SOC 2, HIPAA, ISO, GDPR, and other frameworks
• Generate policies, remediation guidance, and audit evidence on your behalf
• Authenticate users and enforce workspace access controls
• Send product, security, and transactional notices
• Comply with legal obligations and respond to lawful requests

We do not sell personal data. We share information only with subprocessors that help us run the service (cloud hosting, databases, email, analytics) under contractual confidentiality and security obligations, or when required by law.

You control which third-party integrations connect to your workspace. Data retrieved from GitHub, GitLab, Bitbucket, AWS, Azure, GCP, or identity providers stays within your organization's Shieldoq tenant unless you export it.

We retain account and compliance data for as long as your subscription is active and for a limited period afterward so you can export records. You may request deletion of your workspace subject to legal and contractual retention requirements.

See our Security page for technical safeguards including encryption in transit, access controls, and audit logging.

• Access, correct, or delete personal data associated with your account
• Export posture reports, gaps, and evidence from the product
• Object to certain processing where applicable under GDPR or similar laws
• Withdraw consent for optional communications at any time

Privacy questions or data subject requests: privacy@shieldoq.com. We aim to respond within 30 days.