Legal & Governance (Draft Pending Owner & Legal Approval)

Privacy Policy

ShieldLine Cyber handles cybersecurity configuration records and underwriter questionnaires. This policy outlines our data handling practices and safeguards. This policy is in draft status pending final owner sign-off and legal review. Effective Date: October 2026.

Notice for Owner & Legal Review: This document reflects the technical and operational data handling architecture of the platform. Specific disclosures regarding state-specific privacy statutes (such as California CCPA/CPRA) and subprocessor agreements should be formally reviewed by legal counsel.

1. Our Commitment to Data Confidentiality

ShieldLine Cyber ("we," "us," or "our") recognizes that client cybersecurity documentation, system configurations, and underwriter questionnaires contain sensitive operational information. We are committed to maintaining the confidentiality and integrity of all client data submitted to our platform.

2. Information We Collect

We collect only information necessary to deliver our advisory services:

  • Account & Contact Data: Client contact name, business email address, company name, employee count, and company domain.
  • Payment Transaction Data: Transaction amount, currency, Stripe checkout session identifiers, and billing address. Payment card processing is handled directly by Stripe; ShieldLine Cyber never stores, transmits, or has access to full credit card numbers or security codes.
  • Assessment Evidence Exhibits: Completed insurance questionnaires, identity configuration screenshots, backup retention exports, endpoint inventory records, and written policy documents uploaded to the Client Portal.
  • Technical Session Logs: IP addresses, browser user-agent strings, and timestamped authentication events collected when signing in to the Client Portal to detect and prevent unauthorized account access.

3. How We Use Client Information & Strict Non-Disclosure

Client information is used exclusively for the following purposes:

  • Reviewing security posture against underwriter baseline criteria.
  • Compiling customized Findings Reports, Evidence Binders, and Policy Packs.
  • Transmitting transactional engagement notifications (payment receipts, portal access links, and engagement alerts).
  • Maintaining accounting records and fulfilling legal, regulatory, and tax compliance obligations.

Zero Voluntary Disclosure to Insurers or Brokers: We do NOT voluntarily disclose, transmit, or share client evidence with insurance carriers, underwriters, or insurance brokers. Any submission of our deliverables to an insurer or broker is conducted solely and directly by the client.

We do NOT sell, rent, license, or monetize client data, and we do not use client documentation for marketing purposes.

4. Service Provider Processing (Subprocessors)

To provide our digital infrastructure, we engage trusted enterprise cloud service providers who process data under strict confidentiality obligations:

  • Stripe: Payment gateway and checkout processing (PCI-DSS certified).
  • Supabase: Managed cloud database and private object storage (`sprint-evidence`) hosted in the United States.
  • Resend: Transactional email delivery infrastructure for sending customer onboarding messages and operational notifications.

5. Data Storage & Security Safeguards

All customer records and uploaded evidence files are stored on cloud server infrastructure located within the United States. Technical safeguards include:

  • Industry-standard cryptographic transport security (HTTPS/TLS) across all web and portal endpoints.
  • Industry-standard encryption at rest for stored database tables and private storage bucket objects.
  • Database Row-Level Security (RLS) policies ensuring each client's evidence is isolated and accessible only by authenticated order owners and authorized assessors.
  • Multi-factor authentication required for all internal administrative access.

6. Data Retention & Deletion Rights

We distinguish between customer assessment materials (eligible for permanent deletion) and financial transaction records (subject to mandatory legal, tax, and accounting retention).

Customer Materials Eligible for Deletion:

Client evidence exhibits (configuration screenshots, policy documents, network exhibits) stored in private cloud object storage (`sprint-evidence`), intake questionnaire submissions, and associated file metadata. These materials are retained only during the active engagement and applicable operational lifecycle, and are purged upon customer request or standard schedule.

Financial & Tax Records:

Core transaction headers (order ID, checkout email, gross amount, currency, invoice details, and payment timestamps) are retained as required to satisfy federal, state, and local accounting and tax recordkeeping obligations (such as IRS guidelines under Internal Revenue Code Section 6001, where statutory audit and assessment periods typically range from three (3) to seven (7) years depending on applicable jurisdiction and filing status).

Fraud, Dispute & Defense Records:

Stripe payment intent identifiers, chargeback records, dispute notices, and immutable policy assent audit timestamps are retained for the duration of payment card network arbitration rules and applicable commercial contract statutes of limitation to defend against unauthorized charges or commercial claims.

Legal & Regulatory Holds:

Any information subject to an active legal hold, regulatory inquiry, subpoena, or pending dispute is retained until the matter is fully resolved. Specific document retention and destruction schedules remain subject to ongoing review and final determination by business ownership and qualified legal and accounting advisors.

System Retention Baseline: Our system configuration establishes a 180-calendar-day retention threshold (`EVIDENCE_RETENTION_DAYS = 180`) for active client portal access following order creation. Automated continuous scheduled purging is not currently active; routine batch maintenance sweeps are executed periodically via token-authorized administrative controls.

Manual Targeted Deletion Requests: Clients may request early permanent deletion of their eligible assessment materials at any time by emailing hello@shieldlinecyber.com from the verified address used at checkout. Following identity and account ownership verification, an authorized operator manually executes targeted purging of all evidence files and intake questionnaires from active storage and database tables in the ordinary course of business (typically within 5 to 10 business days).

7. Your Rights & Contact Information

Depending on your jurisdiction, you may have rights under applicable state or federal privacy laws regarding the access, correction, or deletion of personal data. To submit a request or inquiry, contact our privacy team at hello@shieldlinecyber.com.