Privacy Policy

Last updated: June 11, 2026

1. Introduction

Shellgate ("we", "us") operates shellgate.ai. This policy explains how we collect, use, and protect your data.

2. Data We Collect

  • Account information: email address, name (provided during signup)
  • OAuth tokens for connected accounts (Google Workspace, Microsoft 365) — encrypted at rest with AES-256-GCM
  • Audit logs of agent actions (API calls, SSH commands, mail operations)
  • Session cookies for authentication

3. How We Use Your Data

  • OAuth tokens: solely to make API calls on your behalf to connected services (Gmail, Google Calendar, Microsoft Graph, etc.)
  • Audit logs: to provide visibility into agent actions within your organization
  • Account information: to provide the service and communicate service-related updates

4. What We Don't Do

  • We do not sell your data to third parties
  • We do not mine or profile the content of your connected accounts
  • We do not access your data except as necessary to provide the service

5. Data Storage & Security

  • All credentials and OAuth tokens are encrypted at rest using AES-256-GCM
  • All connections are encrypted in transit via HTTPS
  • Data is stored in managed PostgreSQL databases

6. Data Retention & Deletion

  • Deleting your account removes all associated data (targets, tokens, connected accounts, audit logs)
  • Organization deletion includes a 30-day grace period before permanent removal
  • Audit logs for deleted organizations are archived and removed after 90 days

7. Cookies

  • We use session cookies only for authentication purposes
  • No tracking cookies, no analytics cookies, no third-party cookies
  • Cookies use httpOnly, secure, and sameSite attributes

8. Third-Party Services

  • Resend: transactional email (account verification, password reset, team invites)
  • Google and Microsoft: connected as authorized by you, access revocable at any time

9. Your Rights

  • You can delete your account and all associated data at any time
  • You can disconnect connected accounts to revoke our access
  • Contact us at privacy@shellgate.ai for any privacy-related requests

10. Changes

We may update this policy. Continued use of the service constitutes acceptance of changes.