Legal
Security
RowShield asks either for nothing, or for a Postgres connection string treated as the most sensitive thing the product holds. Here is what we do with it, and what we are structurally unable to do.
Last updated 24 August 2026
What we hold, per feature
The free Instant Check holds nothing. It accepts a URL and, optionally, the anon key your app already ships to browsers — used for the length of one request and never stored. There is no credential of yours in our database because of it.
Continuous monitoring holds a Postgres connection string. Revoke it by disconnecting the project from your settings, or by rotating the credential on the Postgres side — either stops us cold, immediately, without needing to ask us first.
What the tools cannot do
They cannot write. The public probe issues only GET, HEAD and OPTIONS requests, enforced in the fetch layer itself. The connected scanner runs six fixed statements against pg_catalog and storage.buckets metadata plus a server-version read — all module-level constants with no bind parameters — so there is no code path that could be steered into a write, or into a user table at all.
They cannot be aimed inside a network. Loopback, RFC1918, link-local, carrier-grade NAT and the cloud metadata endpoints are refused before the probe’s socket opens, and re-checked on every redirect hop.
They cannot store what they find. A table the Instant Check can read is reported by its column names and its row count, never the row values. An exposed service-role key or access token is reduced to a short fingerprint before it is used for anything.
They cannot leak your infrastructure through an error. Network and database failures are mapped to a fixed set of phrases before they reach a dashboard or a log; connection strings and other credential-shaped values are replaced with fingerprints wherever text approaches a log.
Encryption and access
In transit. Everything is HTTPS.
At rest. A connection string is envelope-encrypted with AES-256-GCM: a fresh data key per write, wrapped by a key held in a key-management service, with additional authenticated data binding the ciphertext to your organization and project. Move that ciphertext to another tenant’s row and it fails to decrypt, full stop.
Sign-in. Supabase Auth. We store no passwords ourselves.
Rotation. Updating the connection string from your project settings re-encrypts the replacement under a fresh data key. Nothing about the old ciphertext lingers once a project points elsewhere.
What we do not claim
No certifications. No SOC 2 report, no ISO 27001, no PCI attestation. The company is weeks old and we will not imply otherwise. What we offer instead is that every statement above is checkable against the source, and that the scanner is built so the worst-case version of us still cannot write to your database.
No bug bounty yet. We pay nothing for reports today. If that changes it will be announced here first.
Your data, and getting rid of it
Disconnecting a project clears the stored connection string immediately and writes an entry to the account’s audit trail. Deleting your account removes the projects connected to it. An Instant Check leaves nothing behind to delete.
The full picture is in the privacy policy.
Reporting a vulnerability
Email info@useveristria.com with “security” in the subject. We acknowledge every report, agree a disclosure timeline with you, and credit you when it is fixed unless you would rather stay anonymous.
In scope: rowshield.dev, its API, and the probe’s behaviour against a deployed target. Please do not run automated scanners at volume against production, do not touch data belonging to anyone else, and stop once you have proved the point. We will not pursue anyone who reports in good faith and stays within that.
The engineering detail
This page is the summary. These four go through the same controls at the level of the code that implements them.