Security
Last Updated: September 16, 2026
ShoBiz stores some of the most sensitive data a business holds — Social Security numbers, bank account details, credit reports, and signed agreements. This page describes the controls that protect it, in specific terms rather than reassurances.
We hold no third-party security certification today. We would rather tell you that plainly than imply otherwise. What follows is what we actually do, and you are welcome to verify any of it.
1. Encryption
In transit. All connections to the Services use TLS. Traffic between your browser and our servers, and between our servers and our sub-processors, is encrypted.
At rest. The database is encrypted at rest by our hosting provider. On top of that, the most sensitive fields get their own application-layer encryption with AES-256-GCM before they ever reach the database:
| Field | Protection |
|---|---|
| Social Security numbers | AES-256-GCM, key held separately from the database |
| Stored third-party credentials (credential vault) | AES-256-GCM, key held separately |
| Two-factor authentication secrets | AES-256-GCM, key held separately |
| Passwords | bcrypt hash — never stored or recoverable in readable form |
| Two-factor backup codes | bcrypt hashes — shown once, never retrievable |
Application-layer encryption matters because a leaked database dump is not enough on its own: the keys are not in it.
2. Authentication and Access
Passwords are hashed with bcrypt. We enforce a minimum length and complexity, and we never email you your password because we cannot read it.
Two-factor authentication (TOTP) is available on every account. Enrol in Profile → Security, scan the QR code with any authenticator app, and confirm with a code. You receive ten single-use backup codes at enrolment.
- Enrolment is two-step: the secret is only activated once you prove your app produces a valid code, so you cannot lock yourself out.
- Disabling 2FA requires both your password and a current code.
- Sign-in with 2FA never issues a session until the second factor is verified.
Brute-force protection. Repeated failed sign-ins lock the account temporarily, independently of IP-based rate limiting — so an attack spread across many addresses still hits a wall.
Sessions use short-lived access tokens with separate refresh tokens. A password reset revokes every existing session, so changing your password after a compromise actually locks the attacker out.
Role-based access control. Users see only what their role permits, and data is scoped per business so one customer's records are never reachable from another's account.
3. Application Security
- Input sanitisation against NoSQL injection and cross-site scripting on every request
- Rate limiting on authentication, public forms, and subscription endpoints
- Bot mitigation on public forms — invisible checks, not third-party tracking scripts
- Security headers via Helmet, including content security and framing protections
- Rich-text sanitisation so stored content cannot inject script into another user's browser
- Single-use, expiring tokens for password resets, agreement signing, and email confirmation
- Audit logging of significant actions, with monitored error and security logs
4. Infrastructure
The Services run in the United States on managed cloud infrastructure. We use established providers rather than operating our own hardware:
| Layer | Provider |
|---|---|
| Application hosting | Render |
| Database | MongoDB Atlas |
| File and document storage | Cloudinary |
| Email delivery | Amazon SES |
| SMS and voice | SignalWire |
| Payments | Stripe, PayPal, NMI, Clover |
Backups run regularly and are encrypted. Our full sub-processor list is in the Data Processing Addendum.
5. Artificial Intelligence
AI-assisted features process only the text a feature needs. Your data is never used to train ShoBiz models or any third-party model, and our AI vendor is contractually prohibited from training on data we submit.
Every business can switch AI processing off entirely at Business Settings → Privacy & AI. That switch is enforced by a single platform-wide gate that fails closed, so it covers features added after you set it.
6. Your Responsibilities
Security is shared. The strongest platform controls cannot protect an account whose password is reused from a breached site.
- Turn on two-factor authentication, and store your backup codes somewhere safe
- Use a unique, strong password — a password manager is the easiest way
- Give each user their own login; never share credentials
- Review roles and permissions so people see only what they need
- Remove access promptly when someone leaves
- Only upload data you have the right to process
7. Reporting a Vulnerability
We want to hear from you. If you have found a security issue, tell us before telling anyone else, and we will work with you.
Email info@shobizapp.com with the subject line "Security". Include what you found, how to reproduce it, and what an attacker could do with it.
What we commit to:
- Acknowledge your report within 3 business days
- Give you an assessment and a remediation plan within 10 business days
- Keep you updated while we fix it
- Credit you publicly when the issue is resolved, if you want that
Safe harbour
If you follow this policy in good faith, we will not pursue or support legal action against you. We consider security research conducted under these rules to be authorised, and we will say so if a third party suggests otherwise.
To stay within the policy:
- Use only your own test accounts. Do not access, modify, or download anyone else's data.
- Stop as soon as you have proof of a vulnerability. Do not pivot further into the system.
- Do not degrade the service — no denial-of-service, no load or stress testing, no spam.
- Do not use social engineering, phishing, or physical attacks against our staff or providers.
- Give us reasonable time to fix the issue before disclosing it publicly.
- If you encounter personal data, stop, do not save it, and tell us immediately.
Out of scope: reports from automated scanners without a demonstrated exploit, missing best-practice headers with no practical impact, rate-limiting on non-sensitive endpoints, outdated-library reports without a working exploit path, and issues in third-party services we do not control (report those to the provider).
We do not currently run a paid bug bounty. We do offer acknowledgement, and a genuinely serious report will get our full attention.
8. If Something Goes Wrong
If we discover a breach affecting your unencrypted personal information, we will notify you and any required regulator without unreasonable delay and within the timeframes the law requires. For business customers, our Data Processing Addendum commits us to notifying you within 72 hours of becoming aware.
We will tell you what happened, what data was involved, what we have done, and what you should do.
9. What We Are Not
ShoBiz is not a bank, a consumer reporting agency, or a credit repair organisation, and we do not provide financial, tax, or legal advice. See the Terms of Service for the full statement.
No system is perfectly secure. We work hard at this and we will not claim more than that.
10. Contact
VaultWiz LLC (dba ShoBiz)
30 N Gould St Ste 5170, Sheridan, WY 82801, United States
Security: info@shobizapp.com (subject line "Security")
Phone: (424) 234-9134
Related: Privacy Policy · Data Processing Addendum · Terms of Service