SECURITY

Security built around your deployments.

Shivo is designed for a simple promise: tracking every release should never make your data harder to protect. These controls describe the public posture of the product today.

LAST UPDATED - JUNE 23, 2026

Contact usTrust center

AT REST

AES-256

Encrypted storage for deployments and release history

IN FLIGHT

TLS 1.3

Encrypted traffic in production

ISOLATION

RLS

Per-account row-level data isolation

CONTROLS

What protects your data

These controls cover the public app, authenticated surfaces, the database, and the integrations that feed your deployment timeline.

Encryption everywhere

Deployments and release history are encrypted at rest with AES-256 and transmitted over TLS 1.3. Sensitive flows are built around secure browser sessions and protected API boundaries.

Tenant isolation

Every deployment and release event is scoped to your account through Supabase Row-Level Security, so one account can never read or write another account’s data.

Key separation

Public browser keys, server-only service keys, and integration credentials are separated through environment configuration and never exposed to the client.

Authentication

Accounts are protected by Supabase Auth with secure sessions. Authorization is enforced at every route boundary before business logic runs.

Backups

The database is backed up on a regular schedule so customer data can be recovered in the event of a failure, while honoring deletion requests.

No model training

Your deployments and release history are never sold or used to train foundation models. They exist only to power your tracking inside your workspace.

DEVELOPMENT

Secure development practices

Security is enforced in the implementation path rather than handled as a separate checklist at the end.
  • Validate every public API input before business logic runs.
  • Keep authentication and authorization checks at route boundaries.
  • Apply least-privilege access to service keys and infrastructure.
  • Avoid logging customer deployment data, release history, or integration secrets.
  • Run dependency, type, lint, and build checks before production changes ship.

COMPLIANCE

Where we are today

We are transparent about program stage. Enterprise-specific reviews can be handled through the contact path.

IN PROGRESS

SOC 2 Type II

Controls are being mapped and evidence is being collected. A completed audit report is not currently published.

EXPORT & DELETE

Data rights

Export your release history or request full account deletion at any time from Settings.

ACCESS

Least privilege

Service keys and infrastructure access are scoped to the minimum needed to operate the Service.

CUSTOMERS

How to help keep your account secure

ACCOUNTS

Protect credentials

Use strong passwords, avoid shared accounts, and rotate integration keys if exposure is suspected.

DEPLOYMENTS

Verify before you ship

Confirm environment status and rollback records against your own systems before acting on a release.

DISCLOSURE

Report issues quickly

Send security findings through the vulnerability disclosure page.