Security & responsible disclosure

How we protect your data

• Strict per-organization data isolation, enforced and tested on every API route.
• MFA available for all users; required for staff.
• Scanner safety controls: verified ownership, signed authorization, rate limits, blocked private/internal addresses, scope-checked redirects and an emergency stop.
• Least-privilege access, audit logs of every sensitive action, encrypted backups and tested restores.

How our scanner identifies itself

Requests carry the user agent PlainshieldSecurityScanner/1.0. If you see our scanner on a system you did not authorize, email abuse@plainshieldsecurity.com and we will stop immediately.

Reporting a vulnerability

Email security@plainshieldsecurity.com. Please give us reasonable time to fix issues before disclosure, avoid accessing other customers' data, and do not run denial-of-service tests. We will acknowledge reports within two business days.