Security at Shower

Security is foundational to Shower. We host customer code, authentication tokens, and project data, and we take that responsibility seriously. This page describes the controls we have in place today, the standards we are working toward, and how to reach us about security concerns.

1. Compliance Status

We are GDPR-compliant today and are preparing for external security certifications. We are not certified yet, and we do not publish a target date until formal evidence collection with an auditor is under way.

• SOC 2 Type II — planned; preparatory work in progress, no auditor engaged yet
• ISO 27001 — planned; preparatory work in progress, no auditor engaged yet
• GDPR compliance — in effect today, with EU data residency for primary storage of projects in the Europe region

Our infrastructure providers (Vercel, Supabase, Cloudflare, Stripe) maintain SOC 2 Type II and ISO 27001 certifications, and our architecture is designed to align with these standards as we pursue our own certifications.

2. Infrastructure Security

• Hosting: Application served by Vercel with TLS 1.2+ enforced and HSTS enabled. DNS and edge protection by Cloudflare.
• Database: Supabase (PostgreSQL) hosted in the EU — and in the United States for the app database of projects in the United States region — encrypted at rest with row-level security (RLS) enforced on all customer-scoped tables.
• Object storage: Cloudflare R2 (restricted to the European Union, or to the United States for projects in the United States region) with server-side encryption for all stored project files and assets. Copies of project files and backups made before we switched storage on 27 September 2026 remain in our previous storage, which Cloudflare places in Western Europe (or eastern North America for projects in the United States region) on a best-effort basis without a jurisdiction restriction, until they are deleted.
• Sandboxed execution: Customer-generated code runs in isolated Modal containers, never on shared infrastructure. These build containers are not pinned to a region, so an individual build may run outside the EU. Transfers outside the EEA are covered by Standard Contractual Clauses.
• Secrets: Managed through Vercel and Supabase secret stores. No secrets are committed to source control.
• Access control: Production access is restricted to the founder.

3. Code Security

• Static analysis: TypeScript strict mode and ESLint run in continuous integration on changes.
• AI code review: We are rebuilding an adversarial AI review layer that inspects changes for security issues, regressions, and risky patterns. It is not currently enforced on every change.
• Dependency scanning: GitHub Dependabot monitors dependencies and opens PRs for vulnerable packages. Critical and high-severity advisories are resolved within 7 days.
• Secret scanning: GitHub secret scanning and push protection are enabled on the repository.
• Change management: Changes are made through pull requests against the main branch.

4. Data Protection

• Where your data is stored: Your project's files and database are stored in the region the project was created in: Europe or the United States. Unless you choose a region in Settings, a project created from North, Central or South America or the Caribbean gets the United States region while that region accepts new projects; every other project gets Europe. For a project in Europe, your database and your project files are stored in the European Union. For a project in the United States region, the project files and the database your app uses are stored in the United States instead, while your account and the text of your chat history stay in the EU. Copies of project files and backups made before we switched storage on 27 September 2026 remain in our previous storage, which Cloudflare places in Western Europe (or eastern North America for projects in the United States region) on a best-effort basis without a jurisdiction restriction, until they are deleted. Some of the processing runs outside the EU. Our Subprocessors page lists each provider that processes your data. And when a site you publish is delivered to its visitors, it is served through a content delivery network that keeps cached copies on servers in any country, so that pages load quickly wherever the visitor is. We do not control how long each of those copies is kept — our settings let one be served for up to a year without being re-checked, and we have no way to delete it on a schedule. Your stored data stays in those two regions; copies of what you publish do not stay there. Transfers outside the EEA are covered by Standard Contractual Clauses.
• Encryption in transit: All connections use TLS 1.2 or higher.
• Encryption at rest: Database, object storage, and backups are encrypted at rest.
• No AI training on customer data: We do not use customer code, prompts, or generated content to train any AI model. Anthropic does not retain or train on data sent through our API integration.
• Data subject rights: You may request access, export, correction, or deletion of your data at any time. See our Privacy Policy for details.
• Data retention: Account data is retained for the lifetime of your account and deleted within 30 days of account closure, subject to legal retention obligations.

5. Incident Response

We maintain a documented incident response process. In the event of a confirmed security incident affecting your data, we will notify affected customers without undue delay and within 72 hours of becoming aware, in accordance with GDPR Article 33.

To report an active incident or suspected breach, contact incident@smoothly.dev.

6. Responsible Disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability in Shower, please report it to security@smoothly.dev.

We ask that you:

• Give us reasonable time to investigate and remediate before any public disclosure
• Avoid privacy violations, data destruction, or service degradation
• Do not exploit a vulnerability beyond the minimum necessary to demonstrate it

We will acknowledge your report within 3 business days and aim to provide a substantive response within 10 business days. A formal bug bounty program is on our roadmap.

Our standard contact information for security researchers is also published at /.well-known/security.txt (per RFC 9116).

7. Subprocessors & Data Processing

For a complete list of vendors that process customer data, see our Subprocessors page. Business customers can sign our standard Data Processing Agreement.

8. Contact