Privacy Policy
Effective date: 28 October 2026
This policy explains how 1001621100 Ontario Inc., an Ontario corporation operating as ShipAttest ("ShipAttest", "we") handles personal data when you visit shipattest.com, create an account or use the ShipAttest service. We follow the EU General Data Protection Regulation (GDPR) where it applies, and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). For personal data inside content that customers upload, such as names in SBOM metadata, we act as the customer's processor under our Data Processing Agreement, and the customer's own privacy policy applies.
Who is responsible
- •Controller: 1001621100 Ontario Inc., an Ontario corporation operating as ShipAttest
- •Contact for privacy questions, including our privacy officer: dan@shipattest.com
- •EU representative (Article 27 GDPR): appointment in progress. Until it is complete, people in the EU and EU authorities can contact us directly at dan@shipattest.com
What we collect and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account data: name, email address, company name, password (stored only as a scrypt hash), two-factor settings | Create and secure your account and sign you in | Contract, Art. 6(1)(b) |
| Workspace membership, role and invitations, including invitees' email addresses | Team access | Contract; legitimate interest in letting customers invite colleagues, Art. 6(1)(f) |
| Audit trail of actions (who did what, and when) | Security, and customers' record-keeping under the Cyber Resilience Act | Contract; legitimate interest, Art. 6(1)(f) |
| Technical data: IP address, browser type, request logs | Security, abuse prevention and troubleshooting | Legitimate interest, Art. 6(1)(f) |
| Billing contact and subscription status. Card details go directly to Stripe; we never see them | Payments and tax records | Contract; legal obligation, Art. 6(1)(c) |
| Messages you send us | Support | Contract; legitimate interest |
We do not sell personal data, show advertising, or use analytics or advertising trackers.
Cookies
We only use cookies that are strictly necessary: one keeps you signed in (30 days), one remembers the workspace you selected, and one lasts 10 minutes during two-factor sign-in. We use no other cookies, so we don't ask for cookie consent.
Service providers
These providers process personal data for us to run ShipAttest:
| Provider | Purpose | Location |
|---|---|---|
| Render Services, Inc. | Application hosting | Frankfurt, Germany (EU) |
| Neon (a Databricks company) | Database | Frankfurt, Germany (EU) |
| Cloudflare, Inc. | DNS and the network edge in front of our host | Global network |
| Google LLC (Google Workspace) | Sending email (alerts, invitations, confirmations) and our mailbox | USA and other locations |
| Anthropic, PBC | AI triage and draft wording, only when a user starts an AI feature | USA |
| Stripe | Payments, when a workspace subscribes | EU and USA |
To check components for vulnerabilities, we send component identifiers (package names and versions, which are not personal data) to OSV.dev, a service run by Google.
We may also disclose personal data where the law requires it, to protect rights and safety, or to a buyer of our business, which would remain bound by this policy.
International transfers
Our hosting and database are in the EU (Frankfurt, Germany). We operate the service from Canada, which the European Commission recognises as providing adequate protection for personal data handled by businesses subject to Canada's federal privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA). Where personal data is processed outside the European Economic Area, we rely on an adequacy decision of the European Commission (including the EU-US Data Privacy Framework for certified providers) or on the Commission's Standard Contractual Clauses.
How long we keep data
- •Account and workspace data: as long as the account exists. When a workspace is deleted, we delete its data from the live database within 30 days, and it disappears from backups when they expire.
- •Audit trail: for the life of the workspace, because customers may need it to show regulators what they knew and did, and when.
- •Technical logs: up to 30 days.
- •Billing records: as long as tax and accounting law requires.
- •Confirmation and invitation links expire after 24 hours and 7 days respectively; pending two-factor sign-ins after 10 minutes.
Your rights
You can ask for access to your personal data, correction, deletion, restriction of processing and a portable copy, and you can object to processing based on legitimate interest. Email dan@shipattest.com; we reply within one month. You can also complain to a data protection authority, in particular in the EU country where you live or work, or, in Canada, to the Office of the Privacy Commissioner of Canada. If your data is in a customer's workspace, we may pass your request to that customer.
Security
Hosting and database in the EU; encrypted connections (HTTPS, enforced with HSTS); passwords hashed with scrypt; session tokens, API tokens and emailed links stored only as hashes; optional two-factor login with encrypted authenticator secrets; strict separation of customer workspaces; and an audit trail. The Data Processing Agreement lists the measures in full.
Children
ShipAttest is a business service and is not meant for anyone under 16.
Changes
We publish changes on this page and email account holders about material changes before they take effect.