Security and data
How ShiftRight protects your data and your prospects' data, and what is not in place yet.
1. Where your data is stored
ShiftRight runs on Cloudflare: the app on Cloudflare Workers and its database on Cloudflare D1, which runs in Cloudflare's Asia-Pacific region. All traffic uses HTTPS (TLS), and Cloudflare encrypts stored data at rest.
2. Keys, passwords and tokens
The keys and passwords you connect (your AI key, Apollo, HubSpot, mailbox app passwords, calendar addresses and WhatsApp tokens) are encrypted again by ShiftRight with AES-256-GCM, each tied to your account, before they are stored. They are never shown back in the app, never included in exports and never written to the activity log.
3. Your AI and your prospects' data
Michael researches and writes using the AI provider you choose (OpenAI or Anthropic) on your own key, so that provider processes the text under your agreement with them. ShiftRight does not use your data or your prospects' data to train AI models, and does not sell it.
4. Signing in and who can see what
People sign in with Google, Microsoft or a one-time email link; there are no ShiftRight passwords to steal. Sessions use secure, HTTP-only cookies and end after 30 days. In a team, the owner and managers manage company settings and see the team's results; members work on their own leads. The owner can keep everyone on LinkedIn copilot, so nobody can switch on automation that LinkedIn's rules do not allow.
5. Activity log
Settings, under Security and data, shows who did what: sign-ins, approvals, campaigns started, paused and ended, keys and mailboxes added or removed, team and settings changes, exports and deletions, including actions taken by Ask Michael, a connected AI assistant or the LinkedIn extension. Owners and managers see the whole team, and can download the log as a spreadsheet. Entries are kept for two years.
6. Export, erasure and closing an account
You can download all your data (or, as an owner or manager, the team's) as one file at any time. When a person asks you to delete their data, you can erase it in one step: their leads, emails, replies, meetings and WhatsApp chats are removed, and their address stays on your do-not-contact list so they are never written to again. You can close your account yourself, which deletes everything in it.
7. Sending safely
Every email carries a working opt-out link and a one-click unsubscribe header. Bounces and opt-outs stop all further contact. Emails go out in the recipient's working hours, with warm-up limits per mailbox. With HubSpot connected, existing customers and people in a deal are held for your review, and anyone unsubscribed in HubSpot is never emailed. WhatsApp is used only with people who message you first.
8. Service providers
Cloudflare (hosting and database), Stripe (billing), Resend (sign-in emails), and, only when you connect them, your AI provider (OpenAI or Anthropic), Apollo, HubSpot, Google or Microsoft (sign-in and your mailbox), and Meta (WhatsApp).
9. What is not in place yet
We would rather tell you plainly. ShiftRight does not yet have a SOC 2 report, company single sign-on (SAML) or automatic user provisioning (SCIM), or a choice of data region. If you need a security questionnaire answered, email us and we will answer it in writing.
10. Reporting a security problem
If you find a vulnerability, email hello@shift-right.co with the subject "Security". We will reply within two working days and keep you informed until it is fixed. Please do not access other people's data or disrupt the service while testing.
Need a security questionnaire answered?
Write to us and we will answer it in writing.