Security at ShipAttest

• •The application and its database run in Frankfurt, Germany (EU), on Render and Neon.
• •Traffic reaches us through Cloudflare's network. Email is sent through Google Workspace.
• •Payments are handled by Stripe. Card details go directly to Stripe and never reach us.
• •The full list of sub-processors is in the Data Processing Agreement.

• •From the CLI and CI: the component list of each release (package names, versions and package URLs), the product name and version, and the git tag and commit. Your source code is not uploaded.
• •Only if you add --with-usage: short excerpts of the lines that import each direct dependency.
• •AI features, on paid plans and only when a user starts one: for triage, the advisory, the affected component, the product details you entered and any import excerpts; for polishing a report, the draft text. These are sent to Anthropic's API (Claude). Anthropic's commercial terms do not allow it to train models on this data.

• •All connections use HTTPS, and browsers are told to use only HTTPS (HSTS).
• •Stored data is encrypted at rest by our database provider.
• •Passwords are hashed with scrypt, using settings recommended by OWASP. We never store them in readable form.
• •API tokens, session tokens and invitation links are stored only as hashes. A new API token is shown once.
• •Two-factor login with an authenticator app is available to every user, with one-time recovery codes. Authenticator secrets are encrypted with AES-256-GCM.
• •Sign-in, sign-up and the API are rate limited, and new accounts must confirm their email address.
• •Only owners and admins can change the plan or invite people, and exploited-vulnerability alerts go only to them.
• •Every upload, decision and report is recorded in an audit trail with the time and who did it.

You can download the SBOM and VEX document of any release at any time; Business also exports generated documents and the full audit trail. When a workspace is deleted, we delete its data from the live database within 30 days, and it disappears from backups when they expire. Details are in the Privacy Policy and the Data Processing Agreement.

ShipAttest is a young company and does not hold SOC 2 or ISO 27001 certification yet. We are glad to answer your security questionnaire and to explain any of the above in more detail.

If you find a security problem in ShipAttest, email dan@shipattest.com with the details and the steps to reproduce it. We aim to reply within three business days. Please give us reasonable time to fix the problem before you make it public, and do not access other customers' data or disrupt the service. Our security.txt has the same contact.