Data security summary
Collect little
The best protection is not to hold data. Shipfy does not ask for your name, email or company, and network addresses are replaced by a keyed pseudonymous code after 90 days. See the data retention policy.
How data is protected
- Encryption in transit: every page and request goes over HTTPS.
- Hosting: the site and its database run on a DigitalOcean server in Frankfurt, Germany.
- Server access: administrators sign in to the server with SSH keys only; password sign-in is turned off.
- Staff sign-in: staff passwords are stored only as salted hashes, sign-in attempts are limited, and console sessions end after 12 hours. Admin tools also need a secret admin token.
- Browser protection: a Content Security Policy limits which scripts and connections the pages may use, and cookies are HttpOnly and Secure where they can be.
- Backups: the database is copied daily (copies kept 7 days) and the whole server is backed up by DigitalOcean (kept up to about 4 weeks).
- Logs: server logs are kept 30 days.
- Providers: only the companies in the sub-processor list handle data for us.
Report a vulnerability
If you find a security problem, please email info@shipfy.ai with the steps to reproduce it. Please do not access other people's data, run tests that slow down or break the service, or make the problem public before we have fixed it. We will answer within 5 working days and tell you when it is fixed. Shipfy has no paid bug bounty during the beta.
Free beta. Reports are written by AI and can be wrong: decision support only. Not financial or investment advice.
How it works · Privacy · Terms · Cookies · Legal · Cookie settings · info@shipfy.ai · © 2026 Shipfy