Security at Shower

Security is foundational to Shower. We host customer code, authentication tokens, and project data, and we take that responsibility seriously. This page describes the controls we have in place today, the standards we are working toward, and how to reach us about security concerns.

1. Compliance Status

We are GDPR-compliant today and are preparing for external security certifications. We are not certified yet, and we do not publish a target date until formal evidence collection with an auditor is under way.

• SOC 2 Type II — planned; preparatory work in progress, no auditor engaged yet
• ISO 27001 — planned; preparatory work in progress, no auditor engaged yet
• GDPR compliance — in effect today, with EU data residency for primary storage

Our infrastructure providers (Vercel, Supabase, Cloudflare, Stripe) maintain SOC 2 Type II and ISO 27001 certifications, and our architecture is designed to align with these standards as we pursue our own certifications.

2. Infrastructure Security

• Hosting: Application served by Vercel with TLS 1.2+ enforced and HSTS enabled. DNS and edge protection by Cloudflare.
• Database: Supabase (PostgreSQL) hosted in the EU, encrypted at rest with row-level security (RLS) enforced on all customer-scoped tables.
• Object storage: Cloudflare R2 (Western Europe region) with server-side encryption for all stored project files and assets.
• Sandboxed execution: Customer-generated code runs in isolated Modal containers, never on shared infrastructure. These build containers are not pinned to a region, so an individual build may run outside the EU. Transfers outside the EEA are covered by Standard Contractual Clauses.
• Secrets: Managed through Vercel and Supabase secret stores. No secrets are committed to source control.
• Access control: Production access is restricted to the founder.

3. Code Security

• Static analysis: TypeScript strict mode and ESLint run in continuous integration on changes.
• AI code review: We are rebuilding an adversarial AI review layer that inspects changes for security issues, regressions, and risky patterns. It is not currently enforced on every change.
• Dependency scanning: GitHub Dependabot monitors dependencies and opens PRs for vulnerable packages. Critical and high-severity advisories are resolved within 7 days.
• Secret scanning: GitHub secret scanning and push protection are enabled on the repository.
• Change management: Changes are made through pull requests against the main branch.

4. Data Protection

• Where your data is stored: Your database and your project files are stored in the European Union. Several things run outside it. Application logs and observability (Axiom) are processed in the United States. The temporary containers that build your project are not pinned to a region, so an individual build may run outside the EU. And when a site you publish is delivered to its visitors, it is served through a content delivery network that keeps cached copies on servers in any country, so that pages load quickly wherever the visitor is. We do not control how long each of those copies is kept — our settings let one be served for up to a year without being re-checked, and we have no way to delete it on a schedule. Your stored data stays in the EU; copies of what you publish do not. Transfers outside the EEA are covered by Standard Contractual Clauses.
• Encryption in transit: All connections use TLS 1.2 or higher.
• Encryption at rest: Database, object storage, and backups are encrypted at rest.
• No AI training on customer data: We do not use customer code, prompts, or generated content to train any AI model. Anthropic does not retain or train on data sent through our API integration.
• Data subject rights: You may request access, export, correction, or deletion of your data at any time. See our Privacy Policy for details.
• Data retention: Account data is retained for the lifetime of your account and deleted within 30 days of account closure, subject to legal retention obligations.

5. Incident Response

We maintain a documented incident response process. In the event of a confirmed security incident affecting your data, we will notify affected customers without undue delay and within 72 hours of becoming aware, in accordance with GDPR Article 33.

To report an active incident or suspected breach, contact incident@smoothly.dev.

6. Responsible Disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability in Shower, please report it to security@smoothly.dev.

We ask that you:

• Give us reasonable time to investigate and remediate before any public disclosure
• Avoid privacy violations, data destruction, or service degradation
• Do not exploit a vulnerability beyond the minimum necessary to demonstrate it

We will acknowledge your report within 3 business days and aim to provide a substantive response within 10 business days. A formal bug bounty program is on our roadmap.

Our standard contact information for security researchers is also published at /.well-known/security.txt (per RFC 9116).

7. Subprocessors & Data Processing

For a complete list of vendors that process customer data, see our Subprocessors page. Business customers can sign our standard Data Processing Agreement.

8. Contact