Security and data control
This page describes security capabilities that exist in the product today, and clearly labels what is planned. It is documentation for evaluators — not a compliance certificate.
What is live today
Access control (RBAC)
LiveOrganization-scoped roles and permissions control who can view and change projects, settings, members, and integrations. Custom roles are supported for tighter team models.
Enterprise identity
LiveSAML SSO, API keys, and optional 2FA / WebAuthn paths are available for organizations that need stronger authentication than password-only access.
Audit trail
LiveSecurity-relevant actions can be recorded for investigation and accountability. Retention policies are configurable for compliance workflows.
AI is optional
LiveCore project management works with AI completely disabled. You can also use hosted models, bring your own LLM keys, or run local models (e.g. Ollama) depending on deployment.
Encryption and transport
- In transit: production deployments are expected to terminate TLS (HTTPS). Self-hosted operators control certificates at the reverse proxy or load balancer.
- At rest: application data lives in your database and object storage. Disk / volume encryption is provided by the host (cloud KMS, encrypted volumes, or on-prem storage policy) — especially important for self-hosted and private-cloud installs.
- Secrets: integration tokens and keys are stored server-side; webhook receivers verify signatures where configured (e.g. GitHub).
Data ownership
On self-hosted and private cloud deployments, you own the infrastructure, database, and backups. Shrevo does not require your engineering data to leave your network for basic PM features.
On managed Shrevo Cloud (when available for your program), data is isolated per organization. Export and import paths are provided so you can leave with your work.
AI and model data paths
- No AI: disable intelligence features; boards, sprints, docs, and permissions continue to work.
- Bring your own LLM: requests go to the providers you configure (OpenAI, Claude, Gemini, Azure, etc.) under your contracts.
- Local models: keep inference inside your network when you run local runtimes.
- Hosted Shrevo AI: uses managed models when you explicitly enable that path — never as a silent default for “AI-off” workspaces.
Backups
Self-hosted: you operate database and file backups on your schedule. Managed cloud backup SLAs will be published when the public cloud product is generally available — not claimed ahead of that.
Not claimed yet
- SOC 2 / ISO 27001: on the enterprise roadmap; not certified today. We will not put a certification badge on the site until an independent report exists.
- Public uptime SLA: design partner / pre-launch stage. See Status.
Questions for security review
Email sales@shrevo.app for architecture diagrams, data-flow notes, or a design-partner security session.