Skip to content
shiftlabs

Trust centre

Every point on this page restates a commitment already published (data processing agreement, privacy policy, legal notice) or a mechanism that can be verified in the platform’s code. Its source is shown alongside; what is not in place is stated too.

  • Sources verified on 1 October 2026
  • Every statement sourced
  • Limits set out in black and white

The essentials

Paris regionExecution and storage in the Paris region (cdg1); an earlier copy remains in the United States.
EncryptionAES-256-GCM at rest, TLS in transit.
European AI by defaultAnalysis engine: Mistral AI (France). Non-EU providers excluded by default.
No trainingSHIFTLABS’s commitment: your data is never used to train a model.
What we do not claimThe limits are written further down, with the same precision as the rest.Read the limits
Contents

Hosting and location

Where the application runs, and where the data is stored.

  • The application runs on Vercel, in the Paris region (cdg1). Vercel Inc. is a company established in the United States.

    Sources: DPA, art. 6 · mechanism verified in the code

  • Data is stored in Vercel Blob, in the Paris region (cdg1), in a private store.

    Sources: Privacy policy, § 3 · mechanism verified in the code

  • A copy predating the migration to Paris remains in the former store, in the United States, until it is detached. Erasure requests received since the switch apply to the active store (Paris).

    Sources: DPA, art. 6 · Privacy policy, § 4

  • Site host: Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, United States.

    Source: Legal notice

Encryption

On the network as well as on disk.

  • In transit, exchanges are encrypted (TLS), and the site requires browsers to use HTTPS for two years (HSTS header).

    Sources: DPA, art. 5 · mechanism verified in the code

  • At rest, the data recorded by the platform (accounts, interviews, collections, two-factor authentication secrets, log, backups) is encrypted with AES-256-GCM.

    Sources: DPA, art. 5 · mechanism verified in the code

  • The encryption key is held exclusively by SHIFTLABS.

    Sources: DPA, art. 5 · DPA, art. 6

Segregation by client

What each organisation sees, and what it does not.

  • Every access is filtered by client identifier, and each client’s interviews and collections are kept in separate files.

    Sources: DPA, art. 5 · mechanism verified in the code

  • The account directory and the audit log remain files shared by all clients, encrypted with the same key: the segregation is logical, not physical.

    Source: DPA, art. 5

  • The employer only receives aggregated results, never named ones: neither a respondent’s first name nor their full verbatim is passed on to them.

    Source: Privacy policy, § 2

  • Usage logs imported by a client are reduced to aggregates in the browser: no raw line or personal identifier is transmitted, and groups of fewer than five people are merged.

    Source: DPA, art. 2

  • The data is never used to evaluate, rate, rank or sanction a person.

    Sources: Privacy policy, § 2 · DPA, art. 2

Backups

Encrypted snapshots, which do not keep what has been erased.

  • The team can take an encrypted snapshot of critical data at any time: accounts, two-factor authentication secrets, contact requests, and each client’s interviews and collections.

    Sources: DPA, art. 5 · mechanism verified in the code

  • Before a client is deleted or its collections are erased, a safety snapshot is taken, then erased as soon as the operation has succeeded. When a client is deleted, its data is also removed from earlier snapshots.

    Source: mechanism verified in the code

  • Only the 30 most recent snapshots are kept; older ones are permanently erased.

    Sources: DPA, art. 5 · mechanism verified in the code

  • An erasure request is carried out immediately on the active store, and the snapshot taken for the operation is then deleted. Earlier backups (the 30 most recent, with no maximum age) may still contain the data; only the deletion of a client account also removes it from its earlier backups.

    Source: Privacy policy, § 5

Retention

How long the data remains, and how it leaves. Table taken from the data processing agreement (art. 4).

Interviews, verbatims, collected answers, aggregates of imported sources, indicator readings, AI consumption counters
Duration: Duration of the engagement, 24 months at most
Enforcement: Automatic (retention review)
Log of sensitive actions (deletions, purges, publications, restorations)
Duration: 12 months, within the limit of the 500 most recent entries across all clients
Enforcement: Automatic (purge on every write)
Client account after the end of the contract
Duration: 12 months
Enforcement: Manual: the product does not yet record the end of the contract

  • Expired files are identified by a retention review; their purge is triggered by the SHIFTLABS team, never silently.

    Source: DPA, art. 4

  • The log of sensitive actions records the action, its author and its target, never the content of the data.

    Source: mechanism verified in the code

Sub-processors

The list from the data processing agreement (art. 6), copied verbatim: it reflects the actual situation at its update date, not a target.

  • Vercel Inc.

    Role
    Hosting and application execution
    Location
    Execution in the Paris region (cdg1); company established in the United States
    Safeguard
    Standard contractual clauses

  • Vercel Blob

    Role
    Data storage
    Location
    Paris region (cdg1); a copy predating the migration remains in the former store (United States) until it is detached
    Safeguard
    Encryption at rest (AES-256-GCM), key held exclusively by SHIFTLABS

  • Mistral AI

    Role
    Analysis engine (AI)
    Location
    France
    Safeguard
    Processing in the European Union; use of a non-EU engine disabled by default

  • Brevo

    Role
    E-mail sending
    Location
    European Union (French company; hosting in France, Germany and Belgium)
    Safeguard
    Processing in the European Union; the provider's data processing agreement (DPA)

  • Upstash

    Role
    Rate limiting (anti-abuse)
    Location
    London (United Kingdom, a country recognised as adequate by the European Commission); technical data only (hashed fingerprint of the IP address, account or e-mail; counters — never the clear-text value)
    Safeguard
    EU–UK adequacy decision

  • Sentry (Functional Software, Inc.)

    Role
    Error tracking (application monitoring)
    Location
    United States, unless the Sentry organisation is configured for EU residency (to be confirmed according to the Sentry project in use)
    Safeguard
    Standard contractual clauses

  • Several of these sub-processors are established in the United States. These transfers are governed by the European Commission’s standard contractual clauses, supplemented by encryption of data at rest.

    Source: DPA, art. 7

  • Any addition or replacement of a sub-processor is announced to the client, with a reasonable period to object.

    Source: DPA, art. 6

AI providers

Which engine analyses your data, and under which rule.

  • The analysis engine is Mistral AI, a company established in France.

    Sources: Privacy policy, § 3 · DPA, art. 6

  • By default, the platform excludes any AI provider that processes data outside the European Union, even when an access key is present. Reopening it requires an explicit configuration change, and the privacy policy would then be updated before any processing.

    Sources: Privacy policy, § 3 · mechanism verified in the code

  • The platform is model-independent. When a model is saturated, the fallback goes first to another model from the same provider, hence in the same region.

    Source: mechanism verified in the code

  • SHIFTLABS undertakes never to use your data to train a model.

    Sources: Privacy policy, § 8 · Privacy policy, § 2

  • Every agent output is born as a draft or “pending expert review”: no deliverable is handed over without human validation.

    Source: mechanism verified in the code

Authentication and sessions

Who can get in, and how.

  • Client account passwords are stored hashed (scrypt, with a random salt specific to each password).

    Sources: Legal notice · mechanism verified in the code

  • The session is held in a signed cookie (HMAC-SHA256), prefixed __Host-, inaccessible to the page’s scripts and transmitted over HTTPS only. It lasts 7 days at most and is revoked as soon as the password changes.

    Sources: Privacy policy, § 7 · mechanism verified in the code

  • Two-factor authentication with a six-digit code (TOTP, RFC 6238) is available on accounts, with the usual applications (Google Authenticator, Microsoft Authenticator, 1Password…). Once enabled, it is required at every login, including via SSO, and a given code is only used once.

    Sources: DPA, art. 5 · mechanism verified in the code

  • Sign-in with Google or Microsoft (OAuth 2.0) is supported: a button only appears if the provider is enabled, and only an address verified by the provider opens a workspace. The login page states that Microsoft SSO and enterprise SSO (SAML) are not yet enabled.

    Sources: Login page · mechanism verified in the code

  • Login, sign-up, password reset and the contact forms are protected by rate limiting against brute force and enumeration. The rate-limiting service only receives hashed fingerprints, never the IP address or the e-mail in clear text.

    Sources: DPA, art. 5 · mechanism verified in the code

  • Sensitive actions (deletions, purges, publications, restorations) are traced in a log kept for 12 months, up to 500 entries.

    Source: DPA, art. 5

  • The site loads no script and no font from a third-party domain: its content security policy only allows its own resources.

    Source: mechanism verified in the code

What we do not claim

A buyer will check it: better to write it here, with the same precision as the rest.

  • Today we hold neither ISO 27001 certification nor a SOC 2 report, and we claim no certification process in progress.

  • We claim neither SecNumCloud qualification nor HDS certification (health data hosting).

  • We do not say that the whole chain is European: several sub-processors are companies established in the United States, and a copy predating the migration remains in the former American store until it is detached.

    Sources: DPA, art. 7 · DPA, art. 6

  • The published data processing agreement is a draft version: it has no contractual value until SHIFTLABS’s registration details and a legal review are in place.

    Source: DPA, final note

  • Deletion of expired data is not automatic: it goes through a review by the team.

    Source: Privacy policy, § 5

  • We publish no availability commitment (SLA) and no quantified recovery objective after an incident (RPO, RTO), and no backup is scheduled at a fixed interval.

  • Enterprise SSO (SAML) is not offered today.

    Source: Login page

A question from your CIO or your DPO?

Write to us from the contact page, marked “Data protection”.

Write to SHIFTLABS

To go further: assess your AI maturity · estimate the gain from a first agent

Trust centre: what protects your data today, SHIFTLABS