Shield
Start

Security

Private by how it is built.

Here is exactly how we protect your workspace, and what Shield does not cover. We hold no security certifications, and we won’t suggest otherwise.

Protections

01

What stays in your browser

The text you scan never reaches us. That is how the page is built, not a setting.

Scanner results: three findings, each masked, with a Save summary button that saves counts only
Scanning runs in the page
The rules are part of the page. Text and files are checked in your browser’s memory, with no form around them and nothing that posts them.
No way out for the text
The app’s Content-Security-Policy lets the page connect only to our own address, where no route accepts scanned text.
Save keeps counts only
Save summary sends the count per rule, the rule set version, text or file, the file type and the size. The server refuses any other field.
Tested, not assumed
An automated browser test records every request the page makes during a scan and a save, and fails if the text or a match appears in any of them.
Masked on screen
Findings show a masked value, never the full secret. Matches are not written to logs or the activity trail.
Keywords are visible
Anyone who can use the scanner receives the workspace’s keyword list in their browser, because that is where scanning happens. Never add a term that is itself a secret.

02

Who can get in

Only the people you add, and only to what their role allows.

Two-step sign-in: a six-digit code from an authenticator app goes in
No passwords
You sign in with a 6-digit code sent to your email. It lasts 15 minutes, allows 5 tries, and requests are limited per address and per email.
Two-step sign-in
A code from an authenticator app, and ten recovery codes that each work once. Owners can require it for owners and admins.
Secrets kept safe
Authenticator secrets are encrypted with AES-256-GCM. Recovery codes and sign-in codes are kept only as hashes.
Sessions
A random token in a cookie scripts cannot read. We keep only its hash. Sessions end after 14 days.
Roles
Owner, admin, approver, member and auditor. Every page, action and export checks the role on the server, not just in the page.

03

How records are kept

Kept apart from every other company, and checkable line by line.

Activity: three records in the activity trail and a check that none was changed or removed
Each company kept apart
Every record belongs to one workspace and every query is limited to it. A record from another workspace reads as not found.
An activity trail that shows any change
Each record carries a hash of the one before. The database refuses edits, and the Activity page checks the whole chain.
Policies that cannot change
Published versions and the agreements to them cannot be edited or deleted. The database enforces it.
No silent overwrites
When two people edit the same tool or draft, the second save is refused instead of lost.
Encrypted in transit
HTTPS everywhere, with HSTS. Pages refuse to be framed by other sites.

04

Where it lives, and how to leave

One region, few outside services, and your data out whenever you want it.

Privacy and data: retention periods, an export and the 14 days before a deleted workspace is erased
One region
The app and its database run on Google Cloud in us-central1, in the United States. Cloudflare sits in front. Emails go out through Amazon SES.
Backups
The database is backed up every night. Erased data leaves the backups as they expire.
No tracking in the app
No ads or chat widgets anywhere. Google Analytics runs only on our public pages, and only if you accept it.
Your data, any time
Owners download every record as a ZIP of JSON files, and set how long saved scans and read alerts are kept.
Deletion
An owner types the workspace’s name to delete it. Everything it holds is erased 14 days later.

What it covers

A scanner sees only what you show it.

Shield does not block, rewrite or warn inside AI tools, and it is not data-loss prevention. Here is the line.

Covered

  • Text pasted into the Shield scanner

    Checked in your browser

  • Text files up to 1 MB in UTF-8 (.txt .md .csv .tsv .json .log .yaml .yml .xml .ini .cfg .conf .env .sql)

    Read in your browser

  • 21 built-in rules and your keywords

    Patterns and checksums, rule set 2026.10.1

Not covered

  • Text typed or pasted into an AI website or app. Shield does not watch them: there is no browser extension.
  • Word, Excel, PDF, images, screenshots, archives, and text in other encodings.
  • Values in other formats, split across lines, encoded (for example base64), or described in words.
  • Confidential information recognised only by its meaning. No AI model is used.
  • Native apps, other browsers, phones, email, and files uploaded to AI tools.

When no rule matches, the scanner says so. That does not prove the text is safe to share.

Report a problem

Found a weakness?

  1. 01Email us with “Security report” in the subject.
  2. 02Say what you found and the steps to see it again.
  3. 03We reply to every report.

Email a security report

support@theopenngroup.com

Your data, in writing.

Written for India’s DPDP Act 2023 and the EU GDPR.