Security and data

Owners and admins can download everything as one JSON file or a zip of spreadsheets: requests, every vote, comments, releases and translations, subscribers, history and settings. It needs no request to us. How it works.

Import from Canny, Featurebase and Productboard with an API key, from GitHub Releases, or from a CSV or JSON file. Imports can be run twice without adding anything twice. How it works.

Look anyone up by email, see what is held, and erase it: their subscription, the email on their votes and requests, and the emails sent to them. People can also ask for it themselves from a “Delete my data” link on every public page, and confirm from their inbox. Each erasure is logged with a one-way hash, never the address.

Set how long personal details are kept (names, emails and companies on old requests and votes, and unsubscribed people). Requests and counts stay. Off by default, so nothing disappears unless you choose.

On Cloudflare: the application runs on Workers and the database is Cloudflare D1. Traffic is HTTPS only, with HSTS. Cloudflare provides encryption at rest and point-in-time recovery for the database.

GitHub, Slack, Linear and Discord tokens, and webhook signing secrets, are stored encrypted (AES-256-GCM). API keys are stored only as a one-way hash and shown once. Passwords are stored as salted PBKDF2 hashes and checked against known breaches without sending the password anywhere.

Four roles: owner, admin, member and viewer. Only owners and admins can export data or look up and erase a person. Internal notes never reach the public board. API keys can be limited to the actions and the project they need, and can expire.

An audit log records publishing, role changes, key and connection changes, exports and erasures, kept for a year. Every request has its own history.

A strict content security policy, no framing, a separate shadow-DOM widget that cannot read your page, signed webhooks (Standard Webhooks) with replay protection, HS256 user tokens with a required expiry, and rate limits on every public endpoint.

Emailed sign-in links or a password, sessions that can be ended everywhere at once. SSO and SAML are for Team workspaces, built when a Team customer asks, with that customer. Ask from Data and privacy in your dashboard.

Cloudflare (hosting, database, DNS, and its AI models for finding similar requests), Resend (email), Dodo Payments (billing; we never see card numbers), and Anthropic (only the AI features you use, below). GitHub, Linear, Slack and Discord only if you connect them. The full list is in the privacy policy.

AI features send text to Anthropic only when you use them: pull request titles and descriptions for release drafts, release notes for translation and rewrites, request and comment text for tags, summaries and thread summaries, and forwarded emails when email-to-feedback reads them. Similar-request matching uses Cloudflare’s embedding model on request text. Nothing is sent for features you do not use, and each is capped per month.

Sell data, use your readers’ email addresses for our own marketing, or show your board’s contents to anyone but you and your public visitors.

No SOC 2 or ISO 27001 report. If you need one, we would rather tell you now than let you find out in a procurement review.

Data is stored on Cloudflare’s network with no region you can pick. We have no EU-only or other regional hosting option today.

Built on request for Team customers, as above.

Need a data processing agreement or a security questionnaire answered? Email hello@shipnoted.com.