Legal
Privacy Policy
Last updated 2026-07-27.
What we collect
Account: your email address, and, if you sign in with Google or GitHub, the basic profile information those providers share (name, email, avatar).
Your project, to scan it:the Supabase project URL and anon (public) key you paste in. Your scan history stores only a one-way SHA-256 hash of the project URL, so we can recognize repeat scans without keeping the real address in that record. For continuous monitoring — which starts with your first scan — we additionally keep the project URL you've asked us to watch (a re-scan needs a real address, not a hash) and your anon key encrypted at rest (AES-256-GCM); the key is decrypted only in memory, at scan time, and never logged. We never retain a service-role key: if you paste one by mistake, we flag it as a critical finding and don't store it.
Scan results: the findings and fixes from every audit we run, tied to your account, so your dashboard can show your history.
Optional connections: if you connect GitHub, we read your repository contents to scan for committed secrets and vulnerable dependencies, and can open fix pull requests to a new branch for you to review and merge — we never push to your default branch and never apply changes to your production database. If you connect your coding agent, we issue a personal access token (stored only as a hash) that the ShipLock tool on your own machine uses to read your findings. If you turn on a public Verified report, the posture summary at its link becomes shareable — counts and coverage only, never your specific findings — and it stays off until you enable it.
Billing:Stripe handles your card details directly — we never see or store your card number. We keep your Stripe customer and subscription IDs so we know who's paid.
What we don't collect
We never ask for your Supabase service_role key or database password. Any GitHub access is optional, granted by you, and used only to scan your source and open fix PRs you review. Scanning uses only the same public anon key your app's own frontend already exposes to every visitor. We don't read the contents of your database tables — a scan checks configuration (is a table protected, is a key exposed, does an endpoint answer without authentication), not your users' data.
Who we share it with — our sub-processors
These are every third party that processes data on our behalf, what they handle, and why. We don't sell data to anyone, ever. If we add or replace one, we update this list before the change takes effect.
| Provider | What it handles |
|---|---|
| Supabase | Our own database and authentication — your account record, scan history, and monitoring settings. |
| Vercel | Hosting for the ShipLock application itself. |
| Stripe | Billing and subscription management. Card details go to Stripe directly; we never see them. |
| Resend | Transactional email — alerts and receipts. Receives your email address. |
| PostHog | Product analytics on how the app is used. Not your scan data. |
| Anthropic | Turns raw check results into plain-English findings and fixes. This payload never contains your anon key or any row of your data, by construction. |
| GitHub | Only if you connect it: source scanning and fix pull requests. |
Monitoring runs never call Anthropic at all — findings from a scheduled re-check are worked out deterministically from the raw result, so no scan data leaves our own systems on those passes.
Your rights over your data
You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it — email support@shiplock.devand we'll action it. Deleting your account removes your scan history, the monitored project URL, and your encrypted anon key. You can stop monitoring at any time by disconnecting the project or cancelling, and you can revoke coding-agent tokens and turn off the Verified report from your dashboard whenever you like.
If your use of ShipLock means we process personal data on your behalf and you need a data processing agreement, email us and we'll put one in place.
Retention and deletion
We keep scan history so your dashboard can show trends over time. To delete your account and everything tied to it, email support@shiplock.dev — this is a manual process today; a self-serve delete is on our roadmap.