Skip to main content

Security your enterprise can verify

Shine handles real customer voices, recordings, and consent. We protect that data with the controls an enterprise security team expects, and we are glad to show our work.

View subprocessors
  • Encrypted in transit (TLS 1.2+)
  • Encrypted at rest
  • AES-256-GCM on stored credentials
  • Keyless CI · short-lived OIDC
  • No standing SSH access
  • Append-only consent receipts
  • GDPR & CCPA aligned
  • Self-service data export

How we protect your data

Compliance is a document. Privacy has to be built. Four layers, each described plainly enough for your security and legal teams to assess.

Data protection

Customer data is encrypted everywhere it lives.

  • TLS 1.2+ in transit, encrypted at rest
  • Primary data stores hosted on AWS in the United States
  • AES-256-GCM field-level encryption on stored OAuth tokens and API keys
  • Customer content is never used to train third-party AI models
  • AI providers engaged strictly as data processors, with model-training opt-out

Access & authentication

Only the right people reach the right data.

  • One-time passcode and Google sign-in
  • Role-based access control with tenant isolation, enforced at the data layer
  • Secrets in AWS KMS-encrypted stores
  • No standing SSH; operator access through session management
  • Keyless CI using short-lived OIDC credentials, not long-lived cloud keys
  • Edge abuse protection: rate limiting, Cloudflare Turnstile, fail-closed guards

Infrastructure & monitoring

The platform runs on a hardened baseline, monitored continuously.

  • Zero known production dependency vulnerabilities, held as a standing bar
  • Parameterized queries and validated inputs throughout
  • Hourly backups to KMS-encrypted, write-only storage
  • Restore procedures exercised against a documented drill runbook
  • Structured logging and correlation IDs trace each request across the pipeline

Privacy & your rights

Customers can exercise real privacy controls.

  • GDPR and CCPA aligned
  • Consent withdrawal, data export, Do-Not-Sell, and Global Privacy Control honored in-product
  • Self-service data export in one action
  • Data Protection Impact Assessment (DPIA) maintained for our processing
  • Public subprocessor list with purpose and location
  • Data Processing Agreement available on request

How we protect the people in your stories

Shine handles other people’s voices, words, and likenesses. These controls govern how that content is consented to, traced, and undone, the part of our posture specific to what Shine does.

Consent

Consent is dated, and it comes first. Every interviewee verifies their email and agrees, in plain language, to being recorded and used in marketing before any recording begins. The agreement is stored with the date and time it was given, so consent is a record, not an assumption.

Provenance

Every published claim traces to its source. Claims are not written, they are extracted from the recorded interview and pinned to the moment they were said. A grounding score travels with each one, so a paraphrase is never presented as a direct quote.

Revocation

Withdrawal propagates automatically. If a participant revokes consent, or a claim is marked unverified, every Shine-hosted asset built on it is suspended without anyone having to remember where it was used, because each stays linked to the claims it came from. Anything already published outside Shine, like a review the customer posted or a video on their own channel, isn't ours to pull down, so we flag it for takedown and tell you exactly what to remove.

Permanence

The record cannot be quietly rewritten. Verifications, edits, and deletions are written to an append-only history with who made the change and when, and that history outlives the claim it describes. Deletions are recoverable for 30 days before they become permanent.

Reporting a vulnerability

If you believe you have found a security issue, we want to hear from you. Email hello@shine.studio and we will acknowledge your report within two business days and keep you updated as we investigate. We do not pursue researchers who report in good faith and give us a reasonable chance to resolve an issue before it is disclosed.

Everything your security team needs, in one package

Request our security package and we will send our security questionnaire, Data Processing Agreement, and subprocessor list within one business day. Prefer email? Reach us at hello@shine.studio.