ShieldWays is built on a simple premise: a security product should not become a second copy of the data it protects. Here is how the architecture enforces that.
Scanning happens inside the browser extension, on your machine. Prompts, pastes, and uploads are analysed locally before they reach an AI tool — the content is never sent to ShieldWays servers to be scanned. There is no server-side inspection pipeline, proxy, or network appliance in the data path.
When the extension redacts or blocks something, it reports an event containing only the detection type, the action taken, the domain, and a timestamp. Content and preview fields are discarded by the backend by design — the audit store whitelists these four fields, so raw content cannot be persisted even if it were sent.
All traffic between the extension, dashboard, and API is encrypted with TLS. Account and audit metadata is stored in Supabase (Postgres), encrypted at rest with AES-256, with Row Level Security policies restricting each row to its owner.
Plan tiers are issued as server-signed entitlement tokens — the extension cannot grant itself a higher tier, and verification failures fail closed to the free tier. Billing state changes are driven by signature-verified Stripe webhooks.
On Team and Enterprise tiers, organisation policies are signed and enforced by the extension, so individual users cannot quietly exempt themselves from controls their admins configured.
The content-free architecture is designed to support GDPR and HIPAA programs: ShieldWays never processes the sensitive content itself, only enforcement metadata. A SOC 2 Type II audit is in progress — contact us if you need our current documentation for a vendor review.
A complete audit event, as recorded by our backend. Note what is absent: the content that triggered it.
{
"type": "secret", // detection category
"action": "blocked", // what the policy did
"domain": "chatgpt.com", // where it happened
"ts": "2026-07-02T14:32:08Z"
}The value that was blocked never leaves your browser.
Found a vulnerability in the extension, dashboard, or API? We want to hear about it before anyone else does. Report it through our contact page with enough detail to reproduce the issue, and we will acknowledge your report, keep you informed as we investigate, and credit you if you would like once it is fixed. Please give us a reasonable window to remediate before public disclosure.
Report a vulnerabilityQuestions about our security posture, or need documentation for a vendor review? Get in touch.