Trust & Security

ShipReady Metrics reads the confidential signal inside your engineering, cloud, and security systems. It’s built security-first — here is exactly how your data is isolated, protected, and used.

Tenant isolation, enforced in the database

Every row is scoped to your organization. Requests made with your session are enforced by Postgres row-level security, so a member of one organization can't read another's scores, findings, connectors, or decisions. Some server operations (background syncs, exports, scheduled jobs) run with a privileged service role that bypasses row-level security; those code paths filter by organization explicitly.

Least-privilege scopes — and we name what we keep

We request the narrowest scope a provider offers, and recommend short-lived tokens where a provider has no scoped tier. What we keep is narrower than what we read, and the detail matters more than the slogan. Your source code is never stored and your repository is never cloned. Your score inputs are aggregate numbers plus a runtime inventory (e.g. "Node.js 20", count 3), containing no repository or author names. But your repository names, author display names, cloud resource names, and unremediated vulnerabilities ARE stored — in the metrics and findings tables — because the product cannot do its job without naming them: an org-wide AI-readiness percentage that can't tell you WHICH repositories lack tests is a number you can't act on, and a vulnerability nobody can attribute to a resource is a vulnerability nobody can fix. See the exact scopes each connector requests, what it pulls, and which scores it feeds on the data access & permissions page.

Data access & permissions →

Encrypted credentials

Connector tokens are encrypted at rest with AES-256-GCM, accessible only to the service role, and are never returned to a browser or written to a log.

Authentication & provisioning

Email/password and Google OAuth today; a one-time code to the registered email is the default second factor. If the check can't be completed, pages stay readable but privileged changes are refused. An authenticator app (TOTP) is the optional stronger upgrade on the account page. Enterprise SSO (SAML) and SCIM provisioning are available on request during onboarding. SCIM covers Users and Groups: group membership can assign the engineer or executive role but never grants admin, which is granted in the app. Removing a membership revokes data access on the next request via row-level security; it does not delete the user's account or force-end sessions they have open elsewhere.

Append-only audit logging

Sensitive actions are recorded to an append-only audit trail: entries can't be edited or deleted one by one, and are kept for two years (records of ShipReady staff access to your data for 90 days) before a scheduled prune, which skips any organization under a legal hold. Exportable as compliance evidence.

Your data, your control

Export reports and findings to CSV/Markdown, and your own account data on request (a full organization export is on the roadmap); account and data erasure are handled on request as a deliberate, confirmed action. There is no public or programmatic API — confidential tenant data stays inside the authenticated, access-scoped app.

Analytics & consent

Third-party website analytics (Google Analytics, Microsoft Clarity) load only on our public marketing pages — never inside the authenticated app — and, where consent is required, only after you opt in. Analytics never receive tenant data.

AI processing

AI-assisted features send task-scoped data to our AI subprocessor, Anthropic's Claude, only when you use them: the AI Security Audit (normalized finding metadata), the compliance assistant (your question and the relevant readiness context), questionnaire and policy drafting, and summaries of vendor attestations or contract text you paste in. Stored credentials and secrets are never sent.

Infrastructure & architecture

ShipReady Metrics is a multi-tenant SaaS built on managed, independently-audited cloud infrastructure. Every request crosses three layers, and your data is isolated at each.

Browser boundaryEvery response is served over HTTPS/TLS and carries hardened security headers — a per-request Content-Security-Policy with a script nonce and strict-dynamic, HSTS (preloaded), X-Frame-Options: DENY, and X-Content-Type-Options: nosniff. Plaintext transport is never used for your data.
Application (Vercel)The application runs on Vercel's managed platform behind a global CDN. Every request is authenticated and authorized server-side before any data is read; role-based access control (admin / engineer / executive) gates privileged actions.
Database & storage (Supabase)Tenant data lives in a managed Postgres database. Queries made with your session are isolated by row-level security, so they only return your organization's rows; privileged server jobs filter by organization in code. Bulk data is encrypted at rest by the managed platform (AES-256); connector tokens are additionally encrypted by the application with AES-256-GCM and are readable only by the service role.

Pull requests run continuous integration: type-checking, linting, tests, a production build and an automated database-grant audit, plus a tenant-isolation suite that re-applies every migration from scratch and checks cross-tenant access. The fast suite on a pull request runs only the tests affected by the change, and the repository owner can merge without waiting for it. A detailed security architecture overview is available for enterprise review — contact info@persooninc.com.

Subprocessors

Every third party that processes data on our behalf, and what each is used for — including vendors that only run on our public marketing pages and never touch customer data. A Trust Center vendor register lists the narrower set of approved customer-data processors; this page is the complete list.

Supabase: Managed Postgres database, authentication, and storage
Vercel: Application hosting, content delivery, and cookieless Web Analytics on non-homepage marketing pages
Resend: Transactional email (sign-in, invitations, digests)
Anthropic: AI features on demand — security audit, compliance assistant, questionnaire/policy drafting, pasted-document summaries
Google Analytics: Website analytics — public marketing pages; Consent Mode v2 (cookieless until accept) on non-homepage pages. The homepage stays consent-gated.
Microsoft Clarity: Website session analytics — public marketing pages only, consent-gated

Platform trust documents

This is ShipReady Metrics’ own public document pack — the platform policies and overviews we publish. It is not a customer’s evidence pack, and tenant artifacts are not available as public downloads from this page. Each row is a live page. Drafts are marked as such and are not legally binding. Detailed information-security and operational policies are shared with prospective customers under NDA on request, not listed here. Formal certifications are not claimed.

Subscription Terms of Service
The standard self-service subscription terms governing use of the ShipReady Metrics platform — accounts, acceptable use, billing, and liability.
Privacy Policy
How ShipReady Metrics collects, uses, shares, and protects personal data, and the rights available to individuals.
Cookie Policy
Draft — pending legal review
The cookies ShipReady Metrics actually sets — essential sign-in and preference cookies, plus analytics on public marketing pages only. Google sets no analytics cookies until you accept.
Subprocessors
Draft — pending legal review
The third-party service providers ShipReady Metrics engages to process customer data, with their purpose, data categories, and hosting regions.
Security Overview
Draft — pending legal review
How ShipReady Metrics protects customer data: compliance posture, encryption, tenant isolation, access controls, secure development, monitoring, and resilience.
Vulnerability Disclosure Policy
Draft — pending legal review
How to report security vulnerabilities to ShipReady Metrics in good faith, including scope, safe harbor, and our handling process.
Data access & permissions
Connector scopes, what we pull, and which scores they feed — from the same registry the product enforces.
Report a security issue
Public vulnerability-report form. Always reachable; listed in security.txt.

Compliance & vulnerability disclosure

The practices above are how the product is built today. For a Data Processing Agreement, subprocessor change notifications, or the current status of formal certifications, contact info@persooninc.com. Report a security issue via the report form or our security.txt, and see live availability on the status page.

See it on your own data

Connect a source and your Executive Overview populates as the first sync completes — about a minute for small orgs, several minutes for large estates.

Get started

Rolling this out for a larger org? Talk to us about enterprise.