This page summarizes how Shieldify handles personal data, security logs, verification cookies, subprocessors, retention, customer requests, and operational security for the Shieldify Lynx platform.
The CAPTCHA runs on Shieldify servers. Visitor verification never goes to an external captcha vendor.
Cookies keep sessions and visitor verification working. No advertising cookies.
Logs keep metadata and rule decisions, not request bodies, and only for as long as they are useful.
TLS protects the panel and every website behind Shieldify.
Least-privilege access for authorized operators, with administrative changes logged.
Contain, assess and notify affected customers without undue delay.
Shieldify provides managed website protection, traffic intelligence, application firewall controls, verification pages, and customer/admin dashboards. We process data only to operate, secure, improve, and support these services.
For Shieldify account, billing, support, and platform administration data, Shieldify generally acts as a controller. For protected website traffic processed on behalf of a customer, Shieldify generally acts as a processor and the customer remains the controller of its visitor data.
We may process account information, login/session metadata, website configuration, domain/origin data, IP addresses, timestamps, hostnames, request method, request path, user agent, status code, cache status, security decision results, WAF events, challenge status, and operational audit records.
Data is used to provide the service, authenticate users, protect websites, detect and mitigate attacks, investigate incidents, generate customer-visible reports, provide support, prevent abuse, and meet legal or security obligations.
Depending on the context, processing is based on contract performance, legitimate security interests, legal obligations, or consent where required. Security cookies and verification data are treated as strictly necessary for service security.
Shieldify uses cookies and local browser storage to keep the panel secure and to distinguish legitimate visitors from automated or suspicious traffic. Shieldify does not use advertising cookies by default.
| Type | Purpose | Typical duration |
|---|---|---|
| Panel session cookies | Keep authenticated users signed in and protect dashboard access. | Session or configured account lifetime |
| CSRF/security cookies | Prevent unauthorized form submissions and cross-site request abuse. | Short-lived or session-based |
| Website verification cookies | Remember that a visitor passed Shieldify verification during active protection. | Short-lived security window |
| Advanced verification tokens | Support stronger verification for suspicious clients during active protection. | Short-lived security window |
| Theme preference | Remember light or dark mode preference on Shieldify pages. | Until changed or cleared by the user |
When Shieldify processes protected website traffic on behalf of a customer, Shieldify processes personal data only according to the customer's documented instructions and only for providing and securing the Shieldify service. A signed customer-specific DPA can be provided on request.
Personnel and administrators with access to customer data are required to handle it confidentially and only for authorized operational purposes.
Shieldify maintains technical and organizational measures covering access control, encryption in transit, monitoring, backup, incident response, and production isolation.
Shieldify uses a limited set of service providers. Customers can request the current subprocessor list and relevant changes.
Shieldify assists customers with data subject requests, security questions, audit information, and incident response where relevant to the service.
On termination or verified request, Shieldify deletes or returns customer-controlled data unless retention is required for legal, billing, backup, or security reasons.
Reasonable security documentation, policies, and evidence can be made available to customers, reviewers, or public authorities under appropriate confidentiality terms.
Shieldify keeps subprocessor use limited and purpose-specific. The browser check and the CAPTCHA are Shieldify's own and run on the Shieldify server, so visitor verification never goes to an external captcha vendor.
| Provider | Purpose | Data involved |
|---|---|---|
| Tempest Hosting | Edge server hosting, bandwidth, and network-level DDoS filtering in London, United Kingdom. | Protected traffic, logs, and platform data on a dedicated server that Shieldify operates at Tempest Hosting. The United Kingdom is covered by an EU adequacy decision. |
| Stripe | Subscription billing, payments, and invoices. | Account email address, subscription details, and the billing and payment details entered in Stripe Checkout. |
| Shieldify-managed database and storage, internal | Panel data, website configuration, statistics, logs, and backups on the Shieldify-operated server above. | Account data, site configuration, operational logs, and security events. Not a separate external subprocessor in the standard deployment. |
| Discord | Optional customer/admin webhook notifications. | Configured incident summaries and site names. Raw request bodies are not intentionally sent. |
| Google (Google Workspace) | Email sent from shieldify.ee addresses: sign-in and verification codes, alerts, weekly reports, and support messages. | Recipient email addresses and the content of the messages. |
| Let's Encrypt (Internet Security Research Group) | TLS certificates for protected websites, issued and renewed automatically. | The website's domain names. Like every publicly trusted certificate, issued certificates are published in public Certificate Transparency logs. |
| UptimeRobot | Uptime monitoring of the Shieldify website, panel and DNS, and the public status page at status.shieldify.ee, whose status badge appears in the header and footer of shieldify.ee. | Monitoring requests to Shieldify's own services. When a page of shieldify.ee opens, the visitor's browser loads the badge from UptimeRobot, which receives the visitor's IP address and browser details as any website does. The badge sets no cookies. |
Shieldify keeps operational and security logs only as long as they are useful for protection, troubleshooting, abuse prevention, legal compliance, or customer support.
| Data type | Standard target | Reason |
|---|---|---|
| Traffic/request logs | 30 days | Traffic visibility, support, debugging, and attack investigation. |
| WAF audit and security event logs | 14 to 30 days | Rule tuning, false-positive review, and security incident analysis. |
| Breakwave per-website minute statistics, including the top sending IP addresses | 365 days | Attack history and reports in the panel, and abuse investigation. |
| Admin audit logs | 90 to 180 days | Administrative accountability, change review, and abuse investigation. |
| Account and billing records | As legally required | Contract, accounting, and legal obligations. |
| Backups | Rolling backup window | Disaster recovery and service continuity. |
Incident-related records may be retained longer where needed to investigate abuse, protect customers, comply with law, or preserve evidence.
Shieldify avoids collecting request bodies by default where possible. Security logs focus on metadata and rule decisions needed to detect and explain attacks.
Request paths and query strings may be security-relevant and can appear in logs. Customers should avoid placing sensitive personal data in URLs. Shieldify can assist with targeted exclusions or redaction needs.
Customer screens show useful security and traffic information. Internal engine, infrastructure, and stack details are restricted to admin-only operational views.
Traffic and security data is used for protection, diagnostics, reporting, and abuse prevention, not for advertising profiling.
Requests can be sent to contact@shieldify.ee. Shieldify verifies the requester, determines whether Shieldify is acting as controller or processor, and responds within applicable legal timelines. GDPR requests are targeted for response within 30 days unless an extension is legally allowed.
If Shieldify identifies a personal data breach or serious security incident, the response process is to investigate, contain, assess impact, preserve relevant evidence, and notify affected customers without undue delay. Where Shieldify acts as controller, Shieldify will notify supervisory authorities or affected individuals when legally required.
Limit exposure, rotate affected secrets, restrict access, and isolate affected systems where needed.
Identify data categories, affected customers, time window, root cause, and likely risk.
Provide available details, mitigation steps, and contact channel so customers can meet their own obligations.
Administrative access is limited to authorized Shieldify operators who need it for service operation, customer support, incident response, and security maintenance. Internal diagnostics are separated from customer-facing screens so sensitive infrastructure details are not exposed to ordinary users.
Access is granted based on operational need and reviewed when roles or responsibilities change.
Administrative changes and sensitive operations are logged where technically available for investigation and accountability.
Production changes are tracked, tested where practical, and operationally reviewed before or after deployment.
Customers receive clear protection information. Low-level engine, stack, and infrastructure detail remains admin-only.
TLS is used for panel and protected website traffic. Sensitive production secrets are kept out of public code and configuration outputs.
Panel authentication, session security, CSRF protection, role-aware admin views, and strict origin controls protect management functions.
Customer websites are provisioned with per-site configuration, logs, security controls, and operational separation.
Runtime load, traffic pressure, WAF events, attack waves, endpoint signals, and operational logs are monitored for availability and security.
Operational backups and recovery procedures support continuity while respecting retention and deletion requirements.
Shieldify maintains procedures for detection, containment, investigation, communication, and post-incident improvement.
This Trust Center is an operational summary, not legal advice. Customer-specific legal terms, DPAs, and review evidence can be provided through contact@shieldify.ee.