Legal & Trust Center

The agreements, privacy commitments, security overview, and operational policies that govern ShipReady Metrics. The Privacy Policy and Terms of Service are published and in effect; documents still marked as drafts are pending legal and owner review and are not yet legally binding.

Terms

Subscription Terms of Service

The standard self-service subscription terms governing use of the ShipReady Metrics platform — accounts, acceptable use, billing, and liability.

Privacy

Privacy Policy

How ShipReady Metrics collects, uses, shares, and protects personal data, and the rights available to individuals.

Cookie Policy

The cookies ShipReady Metrics actually sets — essential sign-in and preference cookies, plus consent-gated analytics on public marketing pages only.

Subprocessors

The third-party service providers ShipReady Metrics engages to process customer data, with their purpose, data categories, and hosting regions.

Security

Security Overview

How ShipReady Metrics protects customer data: compliance posture, encryption, tenant isolation, access controls, secure development, monitoring, and resilience.

Policies

Information Security Policy

The master policy: how ShipReady Metrics governs security, the policy family it anchors, and the risk-based controls behind them.

Access Control Policy

How ShipReady Metrics governs who can access systems and customer data, including RBAC, MFA, and least-privilege controls.

Encryption Policy

How ShipReady Metrics protects data in transit and at rest, including TLS/HSTS, vendor-managed infrastructure encryption, and AES-256-GCM encryption of connector credentials.

Secure Development Lifecycle Policy

How ShipReady Metrics designs, writes, tests, and verifies software — the automated gates every change passes before production.

Change Management Policy

How application, database, and configuration changes reach production — the automated gates, deployment model, and traceability behind every release.

Vulnerability Management Policy

How ShipReady Metrics identifies, prioritizes, and remediates vulnerabilities in its own service — dependency hygiene, CI gates, and exploit-aware (CISA KEV) prioritization.

Logging & Monitoring Policy

How ShipReady Metrics records security-relevant activity, monitors for failures, and retains and prunes its logs, including the append-only audit trail and its retention horizons.

Data Classification Policy

How ShipReady Metrics classifies the data it actually holds — credentials, customer tenant data, personal data, and public content — and the handling rules for each tier.

Data Retention Policy

How long ShipReady Metrics keeps each category of data it holds — audit logs, compliance evidence, connector data, and personal data — and how deletion actually happens.

Backup & Recovery Policy

How ShipReady Metrics data is backed up and restored, including vendor-provided Supabase backups, application redeploy/rollback, and re-derivable connector data.

Business Continuity & Disaster Recovery Policy

How ShipReady Metrics prepares for, responds to, and recovers from disruptions, including backups, recovery objectives, and continuity planning.

Incident Response Policy

How ShipReady Metrics detects, classifies, contains, and communicates security and availability incidents.

Asset Management Policy

How ShipReady Metrics identifies, tracks, protects, and decommissions its information assets — infrastructure, code, customer-connected data sources, credentials, and data stores.

Third-Party Risk Management Policy

How ShipReady Metrics inventories, assesses, monitors, and reviews the third-party vendors and subprocessors the service depends on.

Responsible AI Policy

Where ShipReady Metrics uses AI (and where it deliberately does not), the human-in-the-loop and no-fabrication rules that govern it, and what data is sent to the model provider.

Vulnerability Disclosure Policy

How to report security vulnerabilities to ShipReady Metrics in good faith, including scope, safe harbor, and our handling process.

Compliance & trust

We report our certification status honestly — nothing is claimed unless held. The Trust & Security overview describes how the product is built today.

SOC 2 Type II: Not yet obtained
ISO/IEC 27001: Not yet obtained

View subprocessors Vulnerability disclosure security.txt info@persooninc.com