This policy explains how Shield Desk handles personal data. Our platform is built to be zero-knowledge: customer content is encrypted on your device before it reaches us, so we store ciphertext we cannot read. This policy covers the limited personal data we do process to run, secure, and support the service.

Data we process

Encrypted customer content. Files and messages are encrypted before upload. We store ciphertext and cannot decrypt it in zero-knowledge workflows.
Account and identity data. Names, work email addresses, and organisation details needed to provide access, governed by your identity provider where configured.
Operational metadata and logs. Timestamps, identifiers, and event types used to run and secure the service. We avoid storing raw message content in logs.
Enquiry data. Information you submit through our contact and demo-request forms, used only to respond to you.

How we use data

We use personal data to provide and secure the platform, authenticate users, maintain tamper-evident audit trails, respond to enquiries, and meet legal and regulatory obligations. We do not sell personal data.

Data minimisation and retention

We design features to minimise how much data we retain and where it lives. Content, metadata, audit logs, and integration data are each handled according to their sensitivity and purpose, and retained only as long as needed to provide the service or meet a legal obligation.

Your rights

Depending on your location, you may have rights to access, correct, or delete personal data, and to object to or restrict certain processing. Under UK GDPR and the Data Protection Act 2018 you may also contact the Information Commissioner's Office. To exercise a right, contact us using the details below.

Sub-processors and security

We use a limited set of vetted sub-processors to host and operate the service. Because customer content is encrypted before it reaches us, sub-processors handle ciphertext rather than readable content. We apply strong technical and organisational measures informed by established security frameworks and industry best practice.

Contact

Questions about this policy can be sent to trevor@getshielddesk.com.