Security & trust
Security is the product — and the practice.
We hold our own service to the standard we enforce for your dependencies.
Protecting your supply chain
Deny by default
Nothing installs until it passes policy. Critical findings never auto-approve, regardless of AI output.
Layered analysis
Known-malicious matching, static rules, behavioral sandboxing, and hash integrity run before any approval.
Signed installers
Agent binaries ship with SHA-256 checksums and a detached signature the installer verifies.
Your data
What we store
Account details, package metadata and verdicts, and telemetry needed to run the service.
Your rights
Export or delete your account data on request. Configurable retention purges old records automatically.
SBOM & evidence
Export SBOMs (CycloneDX, SPDX) and audit logs for compliance and incident review.
Report a vulnerability
Email security@shadowcanopy.dev. We acknowledge reports within 48 hours and will keep you updated through resolution. Please do not disclose publicly until we have shipped a fix.
SOC 2 Type II and ISO 27001 are on our roadmap. Contact us for our current posture and enterprise agreements.