Security
Answers for your security review,backed by code you can read.
Every request goes through the same permission checks. The app can't edit the audit log, and your files sit in private storage for your workspace alone. The AI treats the internet as untrusted.
| 10:42:07 | [email protected] | product.campaign_post_status_changed | approve · 6 posts |
| 10:41:55 | api key · ci | release.created | Recurring invoices |
| 10:39:12 | [email protected] | member.role_updated | creator → approver |
| 10:37:40 | system | post.published | confirmation stored |
Access
Who gets in,and what they can do.
Sign-in, roles, and identity are built on Better Auth. Each workspace is its own Better Auth organization.
Single sign-on
SAML and OIDC, plus Google, Microsoft, and GitHub sign-in. Password sign-in can be switched off.
SCIM provisioning
SCIM user provisioning. Tokens are scoped to one workspace and stored as hashes. Deprovisioned people lose access.
Two-factor
TOTP. A fresh two-factor session is required to configure SSO or SCIM and to connect social channels.
6 fixed roles
owner, admin, creator, approver, publisher, viewer. Approving and publishing are separate permissions.
Sign-in limits
Sign-in attempts are limited to 10 a minute.
Scoped API keys
Five scopes, hashed at rest, shown once, and revoked on the next request. No key can approve or publish.
Authorization
Every request takes the same nine stepsin the same order.
Each request ends with an audit entry saved together with the change.
Sign-in checked
Active workspace
You belong to it
Your role
Permission for the action
Workspace is active
Scoped to the workspace
The change
Audit entry
The browser only decides which buttons to show. The server decides what you can do.
Your data
Your data stays in your workspace,and requests from other workspaces get a 404.
Your login decides which workspace you see. An ID from another workspace returns 404, so nobody can probe for other workspaces' IDs.
org/<organizationId>/…Private storage
Files live in a private bucket with no public domain, under a path the backend won't cross between workspaces.signed URL · 2 minShort-lived links
Uploads and downloads use signed URLs that expire in two minutes. Uploads are write-once, and a replay is refused.two-workspace testIsolation, tested
An automated test with two workspaces proves logins and API keys can't reach the other workspace's releases or assets.web → backend SDKNo database in the web app
The web application has no database connection and no storage credentials. A test enforces it.grace period · tombstoneDeliberate deletion
Deleting a workspace starts a grace period. Afterward, a deletion record and the audit evidence remain.United StatesWhere it runs
The application runs in the United States, in DigitalOcean's New York region, with workflows in AWS US East. Regional data residency is not offered today.
Audit
An audit log the app can only add to,enforced by database permissions.
The application's database role can insert and read audit rows and nothing else.
Append-only
Redacted entries for each workspace, searchable by time, action, teammate, outcome, record, and text.
Hashed IPs
IP addresses are stored as keyed hashes, not raw values.
Retention and legal hold
Ninety days by default. Enterprise sets a longer period or places history on legal hold.
Audit log export
Send events to your security log tool (SIEM) as CloudEvents JSON over HTTPS with an HMAC SHA-256 signature, or use the Splunk and Datadog presets.
Encrypted export secrets
Export credentials are encrypted at rest with AES-256-GCM and never shown back.
Delivery that retries
Exports run every minute, refuse private addresses and redirects, and retry without blocking your work.
AI
The AI is treated as untrusted,and every action it takes is logged.
The AI reads untrusted text, so Shots doesn't trust the AI either. It runs inside one workspace, holds no credentials, and can't approve anything.
No training on your content
Your history is retrieved at generation time for your workspace only. No model is trained on it.Injection defense
Sources are cleaned, labeled as untrusted, and flagged. Read the guardrails.Usage logged, prompts left out
AI actions are audited with the model and usage. Prompt and completion text are kept out of the audit log.
Providers
The services the hosted platform runs onand what each one does.
| Provider | Purpose |
|---|---|
| DigitalOcean App Platform | Application hosting, in the New York region |
| PlanetScale | Managed PostgreSQL |
| Upstash | Redis for rate limits and caching |
| Cloudflare R2 | Private object storage for assets |
| Cloudflare Browser Rendering | Headless rendering of visuals |
| Temporal Cloud | Workflows that survive restarts, for publishing and maintenance, in AWS US East |
| Resend | Account, invitation, and release email |
| OpenRouter | Model routing for AI features |
| Microlink | Screenshot capture API |
| PostHog | Product analytics |
Questions
Anything else? Talk to us.
Do you have SOC 2 or ISO 27001?
How do I report a vulnerability?
Who can see our workspace?
Related