Security at DPP Shield

Hosting and data location

DPP Shield is operated by PRIME NEXUS INTERNATIONAL LLC. The application, database and cache run on servers provided by OVHcloud (OVH SAS) in France. Uploaded documents and encrypted backups are stored with Hetzner Online GmbH in Germany. Customer data at rest is therefore kept in the European Union.

Website measurement and some optional features (Sign in with Google, AI assistance, payments) involve providers that may process data outside the EU; they are listed under Sub-processors below.

Encryption

• All traffic to dppshield.com and api.dppshield.com is encrypted with TLS, and HSTS tells browsers never to connect without it.
• Integration secrets (store credentials, identity-provider secrets, AI provider keys, MFA seeds) are encrypted in the database with AES-256-GCM.
• API keys are stored only as SHA-256 hashes and shown once at creation. Passwords are hashed with scrypt.
• Backups are encrypted with AES-256 (GnuPG) before they leave the server.

Access control

• Every request is checked against the organization it belongs to; one customer's data is never served to another.
• Roles (owner, administrator, editor, viewer) limit what each member can change. Publishing and other sensitive actions can require a recent second-factor check.
• Multi-factor authentication (TOTP) is available to every user and can be made mandatory per organization.
• Single sign-on with your identity provider (OIDC or SAML) and SCIM user provisioning are available.
• Sessions have an absolute lifetime and an idle timeout that your organization can tighten; sessions can be listed and revoked.
• API keys are scoped per resource (for example products:read) and can be given an expiry date.

Application security

• A strict Content Security Policy, frame protection and no-sniff headers on every response.
• Uploaded files must be an allowed document or image type, verified from their content, and every upload is scanned for malware before it is stored.
• Requests to addresses you configure (webhooks, identity providers, connected stores) cannot reach private networks.
• Spreadsheet exports neutralize formula injection.
• Rate limits on sign-in, sign-up, public endpoints and the API.
• An append-only, hash-chained audit log records changes in your organization.

Operations and resilience

• Server access uses SSH keys only; password and root logins are disabled. A firewall exposes only the web ports.
• Operating-system security updates are installed automatically.
• Encrypted backups of the database and configuration are taken nightly, copied off the server, and kept for 30 days. A restore from the offsite copy is tested every month.
• The service is monitored every 15 minutes, with alerts to the operations team. Live status and measured uptime are published at dppshield.com/status.

Incidents and vulnerability reports

If a personal data breach affects your data, we notify you as set out in the Data Processing Agreement.

To report a vulnerability, e-mail contact@dppshield.com with the subject "Security". Please give us reasonable time to fix an issue before disclosing it, and do not access other customers' data or degrade the service while testing.

Sub-processors

These providers process personal data on our behalf. We notify customers before adding or replacing one (see the Data Processing Agreement).

Data Processing Agreement

When you use DPP Shield for your organization, you are the controller of the personal data you put in it and we act as your processor. Our Data Processing Agreement (GDPR Article 28) is published at dppshield.com/en/dpa and forms part of the terms of service.