Security

Every table holding user data enforces row-level security in the database, so a request authenticated as one user cannot read or modify another user's records. This is enforced by the database itself, not only by application code, so a bug in the app cannot quietly bypass it.

Uploaded screenshots and PDFs go to a private storage bucket with no public read access. Files are namespaced per user and access policies are scoped to the owner. Storage is encrypted at rest by our infrastructure provider, and all traffic is encrypted in transit over TLS.

When a document needs to be analyzed, the server generates a short-lived signed URL valid for five minutes. There are no permanent public links to your files.

Analysis runs server-side. Your documents and text are sent to our AI provider, OpenAI, with retention disabled, and are not used to train models. Your device never sends your data directly to a third party — requests go through Shieldova's backend, which applies authentication, ownership checks, and plan limits first.

We list every service provider that receives your data in our Privacy Policy.

Sessions use signed JWT tokens with automatic refresh, and tokens are held in the device's secure storage. Passwords are hashed by our authentication provider and are never visible to Shieldova.

Payments are processed entirely by the Apple App Store and Google Play. Shieldova never receives or stores your card details.

Deleting your account removes your uploaded files from storage, revokes your active sessions, and permanently deletes your account and every record linked to it. There is no soft-delete or hidden retained copy in the application database.

Shieldova has not completed a SOC 2 audit or an independent third-party penetration test, and we do not claim compliance with frameworks we have not been assessed against. Shieldova is not a HIPAA covered entity or business associate. No system is perfectly secure, and we cannot guarantee absolute security.

If you believe you have found a security issue, email support@shieldova.com with steps to reproduce. Please give us a reasonable opportunity to fix the issue before disclosing it publicly. We will not pursue legal action against good-faith research that respects user privacy and avoids service disruption.