LEGAL POLICY & COMPLIANCE FRAMEWORK

Privacy Policy

Last Updated: September 23, 2026 • Version 4.0 (Commercial Launch Edition)

LEGAL NOTICE: This document represents the standard commercial terms and data handling framework of Shieldmix One. While drafted in strict alignment with GDPR, CCPA, and defensive security standards, enterprise customers may execute customized Data Processing Addendums (DPA) upon request.

1. Information We Collect

Shieldmix operates as an authorized defensive cybersecurity platform. We collect and process data strictly necessary to provide our scanning, vulnerability management, and authorized penetration testing services:

Account & Identity Data: Name, work email address, company name, hashed passwords (bcrypt with cost factor 12), and encrypted Multi-Factor Authentication (TOTP) secrets.
Asset & Target Telemetry: Domain names, IP addresses, web endpoints, API schemas, and DNS configurations submitted by customer administrators.
Security Observations & Findings: Configuration metrics, HTTP headers, TLS handshake parameters, open port indicators, and vulnerability evidence generated during authorized scans.
System Audit Records: Cryptographically hash-chained audit trails recording user logins, target verification tokens, scan invocations, and configuration changes.

2. Strict Defensive Data Minimization

Shieldmix does NOT collect, capture, or store sensitive end-user passwords, credit card numbers, or proprietary business payload data encountered during scanning:

When scanner checks identify exposed files (such as .env or .git entries), only cryptographic SHA-256 hashes and redacted response headers are retained as evidence.
Evidence artifacts generated during human pentesting are stored with AES-256-GCM encryption at rest and accessible solely via signed, short-lived URLs restricted to authorized tenant roles.

3. Data Retention & Lifecycle

By default, security findings and scan histories are retained for 365 days to maintain historical posture trending and compliance reporting. Enterprise customers can configure custom retention policies (90 days, 180 days, or 7 years) to satisfy jurisdictional compliance mandates.

4. Customer Data Portability & Controlled Deletion

In compliance with global privacy regulations:

Asynchronous Export: Authorized organization owners can export all verified assets, vulnerability reports, and audit logs in JSON format via /api/orgs/:id/export.
Controlled Deletion: Organizations may request permanent deletion with a mandatory 30-day statutory cooldown via /api/orgs/:id/delete. All automated background jobs and recurring billing cease immediately.

5. Privacy Contact & Data Protection Officer

Inquiries regarding data processing, privacy rights, or Data Processing Addendums should be directed to our Security & Legal Operations team at privacy@shieldmix.com.