All legal documents

Data Protection

Last updated: March 16, 2026

1. Data Protection Overview

sh0 is committed to protecting your personal data. We implement technical, organizational, and legal measures to ensure your data is secure, confidential, and only used for the purposes you authorize.

2. Data Protection Principles

  • Lawfulness: Data processing is based on legal grounds (consent, contract, legal obligation)
  • Fairness: We are transparent about data collection and use
  • Transparency: You know exactly what we collect and why
  • Purpose Limitation: Data used only for stated purposes
  • Data Minimization: We collect only what is necessary
  • Accuracy: We keep your data accurate and up-to-date
  • Storage Limitation: Data stored only as long as needed
  • Integrity & Confidentiality: Secure processing and storage

3. Categories of Personal Data

3.1 Essential Data (Required)

  • Email address
  • Password (hashed with Argon2)
  • Account name or organization
  • Billing address (if paid user)

3.2 Operational Data (Automatically Collected)

  • IP address and device information
  • Login dates and times
  • Features used and interaction patterns
  • Container metrics and usage data
  • Error logs and debugging information

3.3 User-Generated Data

  • Deployment configurations and environment variables
  • Git repository references
  • Application source code (during build process)
  • Backup data and snapshots
  • Preferences and dashboard settings

3.4 Sensitive Data (Special Care)

  • Secrets: API keys, database credentials (AES-256-GCM encrypted)
  • Environment Variables: Encrypted at rest and in transit
  • SSH Keys: Never stored in plain text

4. Data Minimization

We only collect and store the minimum data necessary to:

  • Provide the sh0 deployment service
  • Ensure security and prevent fraud
  • Comply with legal requirements
  • Support you with customer service
  • Improve the platform (with your consent)

5. Data Storage & Infrastructure

  • sh0 Cloud Locations: EU (Hetzner) and US (Contabo)
  • Internal Database: SQLite with full-disk encryption
  • Backup: Encrypted backups with configurable retention (local, S3, R2)
  • Redundancy: Data replicated per your backup policy

6. Data Access Controls

Only authorized personnel can access your data:

  • Admin Access: Limited to essential staff (debugging, support)
  • Logging: All data access is logged and monitored
  • Purpose: Access only for legitimate business purposes
  • Training: Staff trained on data protection
  • NDA: All staff sign confidentiality agreements

7. Data Encryption

  • In Transit: TLS 1.3 encryption for all communications
  • At Rest: AES-256-GCM encryption for secrets and sensitive data
  • Passwords: Argon2 hashing
  • API Keys: Encrypted and rotatable
  • Backups: Encrypted with user-configurable keys

8. Third-Party Data Processors

ServiceData TypePurposeCompliance
OpenRouterCode snippetsAI analysisNo data retention
StripePayment infoBillingPCI DSS, SOC 2
HetznerPlatform dataInfrastructure (EU)GDPR, ISO 27001
ContaboPlatform dataInfrastructure (US)GDPR compliant

9. Data Retention Policy

  • Active Accounts: Data retained for account lifetime + 30 days after deletion
  • Deployment Logs: Retained for 30 days by default (configurable)
  • Build Artifacts: Retained while deployment is active
  • Backup Data: Retained per your backup policy configuration
  • Payment Records: Retained 7 years (tax/legal requirement)
  • Support Tickets: Retained 2 years
  • Analytics Data: Anonymized and aggregated (no deletion needed)

10. Data Subject Rights

You have the following rights regarding your data:

  • Right to Access: Get a copy of your data anytime
  • Right to Rectification: Correct inaccurate data
  • Right to Erasure: Delete your data ("right to be forgotten")
  • Right to Restrict Processing: Stop processing without deletion
  • Right to Data Portability: Download data in machine-readable format
  • Right to Object: Opt-out of processing (within limitations)
  • Right to Appeal: Challenge decisions made by automated means

11. Data Security Incidents

In case of a data breach:

  • Assessment: We immediately assess the scope (within 24 hours)
  • Notification: Affected users notified within 72 hours (GDPR requirement)
  • Authorities: Reported to relevant authorities if required
  • Mitigation: Immediate steps to prevent further damage
  • Transparency: Full disclosure of what happened and its impact

12. Data Protection by Design

sh0 implements data protection throughout development:

  • Privacy reviewed in all new features
  • Default to most privacy-protective settings
  • Privacy impact assessments (DPIA) for high-risk processing
  • Regular privacy audits and assessments
  • No unwrap() in production code -- all error paths handled securely

13. Self-Hosted Data Protection

For self-hosted sh0 installations:

  • All data remains on your servers under your control
  • No telemetry sent to sh0 without explicit opt-in
  • You manage your own backup and encryption policies
  • Secrets encrypted with AES-256-GCM using the ring cryptography library

14. Compliance Standards

  • GDPR (EU): Full compliance for EU users
  • CCPA (California): Full compliance for California users
  • SOC 2: Type II audit (planned)
  • ISO 27001: Information security certification (planned)

15. How to Exercise Your Rights

To request any of the above rights:

  1. Email [email protected]
  2. Include: your name, email, account ID, and specific request
  3. Provide valid identification for verification
  4. We respond within 30 days (GDPR standard)
  5. Extensions available if request is complex (max 90 days)

16. Data Protection Officer Contact

For data protection inquiries: