Our Security Principles & Practices
How we protect our customers, enforce safety boundaries, and build a trustworthy defensive cybersecurity platform.
Mandatory Target Ownership Verification
Shieldmix strictly refuses to execute active security scans on any domain, IP, or repository without cryptographic ownership proof (DNS TXT record, HTML verification file, or signed enterprise authorization).
Hardened SSRF & Cloud Metadata Protections
All scanner worker egress passes through multi-stage network validation. Targets resolving to 127.0.0.0/8, 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, and cloud metadata (169.254.169.254) are rejected immediately.
Zero Exploitation & Non-Destructive Payloads
Phase 1 engine is explicitly non-destructive. No denial-of-service stress tests, no brute-force credential stuffing, no memory corruption payloads, and no data exfiltration routines.
Minimal Sensitive Data Retention
When exposure probes identify configuration anomalies (such as exposed .env or .git files), only lightweight cryptographic signatures are verified. Customer secrets and credentials are never stored in plain text.
Immutable Tenant Audit Logs
Every scan request, status change, login attempt, and verification check is permanently appended to immutable audit tables. Ordinary tenant UI cannot delete or alter log history.
Emergency Kill Switch & Rate Throttling
Both platform operators and customer administrators can instantly engage an Emergency Security Pause to immediately terminate all active network operations.