Security
Security built around your specs.
Writing a spec should never make your plans harder to protect. These controls describe how Shivo handles your content today.
Last updated · October 23, 2026
Transport
TLS
Encrypted traffic in production
Storage
RLS
Per-account database access
Training
No
Your specs are not used to train models
Controls
What protects your content
The controls below cover the public site, the signed-in workspace, the demo and the AI provider integration.
Your plans stay yours
Specs, requirements and comments are scoped to your account. Shivo does not sell them or use them to train models.
Encryption
Traffic is served over TLS in production, and stored content is encrypted at rest.
Per-account access
Supabase Row Level Security policies return only the rows that belong to the signed-in account.
Key separation
The browser only ever holds the public database key. The AI provider and service keys stay on the server.
A separate demo
The demo workspace runs on seeded sample data. It never reads real accounts and never calls the AI provider.
Account control
Export your data as JSON, download any spec as Markdown, or delete your account from Settings.
Development
Secure development practices
Security is part of how the product is built, not a checklist at the end.
- Check authentication on every route that reads or writes account data.
- Validate and rate-limit public form input before it is used.
- Keep provider keys out of the browser and out of logs.
- Keep the demo path apart from real accounts and real providers.
- Run type, lint and test checks before changes ship.
Customers
How to help keep your account secure
Accounts
Protect credentials
Use a strong password, do not share accounts, and change your password if you think it has leaked.
Content
Share only what you may
Describe features and paste documents you wrote or are allowed to share.
Disclosure
Report issues quickly
Send security findings through the vulnerability disclosure page.