Security, Privacy & Terms

1. What ShipSecure does (and doesn’t)

ShipSecure tests how an AI agent behaves under defined security scenarios, maps the results to questions enterprise buyers ask, and publishes the evidence in a Live Trust Link and Trust Report.

• This is verification against ShipSecure’s defined methodology, not a certification.
• Results apply only to the agent version, scope and date shown.
• A Trust Link supports a security review. It does not replace a buyer’s own questionnaire, review or judgement.
• When a customer asks, we help them prepare answers to their buyer’s security questionnaire from the test evidence. The customer reviews and approves every answer before it is shared, and questions our testing does not cover are marked as such.
• ShipSecure tests and recommends. We do not operate, control or enforce guardrails in our customers’ systems.

2. Security

We sell trust, so we hold ourselves to the standards we test for.

How we test

• We test only with the customer’s written authorisation, which sets out the systems, dates and techniques allowed.
• We test on a staging (test) copy of the customer’s system, not their live production system, and ask customers to use fake data in it.
• Test logins are kept in a password manager, never in our application, and are deleted when the assessment ends.

How we protect evidence

• Evidence is stored with Supabase in the European Union, encrypted at rest, and sent over encrypted (HTTPS) connections.
• Access is limited to the ShipSecure team, using accounts protected by two-step verification and the minimum permissions each person needs.
• If real personal data appears in test output, we redact it before storing it.
• Customer evidence is confidential by default. Only what the customer has approved for publication appears on a Trust Link.
• Every publish, edit and withdrawal of a Trust Link is logged.

3. Reporting a security issue

If you believe you have found a security vulnerability in ShipSecure’s website or services, please email security@tryshipsecure.com with the subject line “Security report”.

Please:

• give us enough detail to reproduce the issue;
• give us reasonable time to fix it before telling anyone else;
• not access, change or delete other people’s data, disrupt our services, or use social engineering or physical attacks.

We will acknowledge your report, keep you updated, and work with you, not against you, when your research is in good faith and follows these rules.

4. Privacy

ShipSecure is the controller of the personal data described below. We follow the data protection laws that apply to us, including the UK GDPR and the EU GDPR.

4.1 What we collect and why

We show Trust Link visit information (organisation name, date, number of opens) to the customer who shared the link. We do not contact Trust Link visitors unless they have agreed to it.

4.2 Who we share it with

We do not sell personal data. We use these service providers, who process data on our behalf:

The customer who shared a Trust Link receives the visit information described above. We may also disclose data where the law requires it.

Where data leaves the UK/EU (e.g. Calendly, Cloudflare’s global network), we rely on the provider’s recognised safeguards for international transfers, such as standard contractual clauses.

4.3 How long we keep it

Customers can ask us to delete their assessment data at any time.

4.4 Your rights

You can ask to access, correct, delete or receive a copy of your data, to object to or restrict how we use it, and to withdraw consent at any time. Email hello@tryshipsecure.com. You can also complain to the UK Information Commissioner’s Office (ico.org.uk) or your local data protection authority.

4.5 Cookies

The ShipSecure website and Trust Links do not set advertising or tracking cookies. The website uses your browser’s session storage to avoid counting the same event twice. The booking calendar (Calendly) may set its own cookies when you open it.

5. Terms of use

These terms cover use of tryshipsecure.com and Live Trust Links. Assessments for customers are governed by a separate written agreement.

1. Not a certification or guarantee. Trust Links and Trust Reports report the results of verification against ShipSecure’s defined methodology, for the agent version, scope and date shown. They do not certify, and do not guarantee, the security, safety, compliance or behaviour of any system outside that scope or after that date.
2. Your own review. Information on a Trust Link supports your own assessment. You should not rely on it as the only basis for a decision. Our responsibilities are to the customer the Trust Link describes, under our written agreement with them.
3. Information provided by customers. Where a Trust Link includes material provided by the customer, it is labelled “Provided by [customer], not tested by ShipSecure”. We have not verified that material.
4. Access. A Trust Link may be shared only by, or with the permission of, the customer it describes. Do not try to access Trust Links you have not been given, or to get around an access code or expiry.
5. Intellectual property. The ShipSecure name, logo, website and methodology belong to ShipSecure. Trust Link content belongs to ShipSecure and the customer it describes, and may be viewed for evaluating that customer only.
6. Liability. To the extent the law allows, ShipSecure is not liable for losses arising from use of the website or a Trust Link. Nothing in these terms limits liability that cannot legally be limited.
7. Changes. We may update this page; the date at the top shows the latest version.
8. Law. For customers, the governing law and courts are those set out in your customer agreement. For everyone else, these terms are governed by the laws of the jurisdiction in which ShipSecure is incorporated.