Trust & Security
Draft version - last updated [date]
Draft placeholder. This text is a starting skeleton for the legal/security team to rewrite and finalize before launch. Do not publish claims (encryption standards, certifications, sub-processors) that are not actually true yet - replace every bracketed [placeholder] with a verified fact first.
1. Our Approach to Security
Security and data protection are part of how we build Shep, not an afterthought. This page describes the practices and controls we apply to protect your data and our infrastructure.
2. Data Encryption
Data is encrypted in transit using TLS and at rest using industry-standard encryption. [Confirm actual encryption standard, e.g. AES-256, once infrastructure is finalized.]
3. Infrastructure and Hosting
The Service is hosted on [cloud provider / region]. Production infrastructure is separated from development and staging environments. [Add details on backups, redundancy, uptime target once decided.]
4. Access Controls
Access to production systems and customer data is limited to authorized personnel on a need-to-know basis, protected by [MFA / SSO - confirm actual setup]. Access is logged and reviewed periodically.
5. Compliance and Certifications
We design our data handling with GDPR principles in mind. [Do not claim SOC 2, ISO 27001 or similar certifications unless actually obtained - list only what is verified and current.]
6. Sub-processors
We use a limited number of third-party service providers to operate the Service (e.g. hosting, email delivery, analytics). [List actual sub-processors and their purpose once finalized.]
7. Incident Response
We maintain a process for identifying, assessing and responding to security incidents, including notifying affected customers as required by applicable law. [Add specific notification timeline once defined.]
8. Reporting a Security Issue
If you believe you've found a security vulnerability, please report it to security@shep.io [replace with real contact]. We ask that you report responsibly and do not access or modify data that isn't yours.
9. Contact
For security or trust-related questions, contact security@shep.io [replace with real contact].