Your information.
Handled with purpose.

ShieldIQ is a service of Business Risk Solutions Namibia CC. This policy describes the approach to customer information in the ShieldIQ web platform, mobile applications, document storage and supporting processing services. It can be retained as part of a customer’s supplier-assurance file.

It supplements the Privacy Policy and the applicable service agreement. It does not replace a signed data-processing agreement, establish a new service-level guarantee or amend an existing contractual commitment. Any conflict in retention periods or responsibilities must be resolved with the customer in writing; publishing a new version does not silently vary an agreed contract.

For records uploaded or created by an organisation, that organisation normally determines why information is processed and who should have access. ShieldIQ processes those records to provide the service. We separately manage account, billing and support information needed to operate our business. The precise legal roles and obligations depend on the applicable law and agreement.

The information held depends on the modules a customer uses and the material its authorised users submit. It can include:

• Company, site, project, user and business contact details.
• Personnel, contractor, induction, training, certificate and appointment records.
• Inspections, permits, risk assessments, incidents, hazards, actions, meetings and audit evidence.
• Policies, procedures, attachments, photographs, signatures, customer feedback and quality records.
• Health-related or other sensitive information where a customer includes it in a supported workflow.
• Authentication, device, usage, notification, support and transaction information needed to run the service.

Different records take different paths. The following describes the main stages so customers can distinguish information in a working record from a temporary processing copy or an external disclosure.

Customer records remain the customer’s records. ShieldIQ uses them to deliver the requested functionality: storing and displaying information, processing documents, routing work, providing notifications, supporting authorised reviews and producing reports. We also process information where necessary for support, security, billing or a legal obligation.

We do not sell customer personal information. Access or disclosure is limited to the purposes described in the Privacy Policy, the customer’s authorised use of the platform and applicable legal requirements. A customer’s instruction to send a document, invite a reviewer or create a share link is itself a disclosure instruction.

ShieldIQ uses cloud infrastructure with a serverless web application layer. In this model, application requests run on cloud-managed compute that can scale with demand. The cloud provider manages the underlying compute platform, while ShieldIQ remains responsible for its application, configuration and access controls.

The complete service also includes persistent databases, private document storage and background processing. Serverless delivery does not mean that customer records disappear when a request ends, nor that every component is serverless. Long-running tasks and stored records have their own access and retention controls.

Security relies on several layers working together: authenticated application access, company and role checks, controlled file access and cloud-service permissions. Detailed network layouts, credentials and operational security settings are not published in this document.

The application uses authenticated database connections to manage structured records. Customer users interact with those records through the application and its authorised interfaces; a customer login is not a database login.

Company context, record ownership and permission checks govern access to company information. Role and capability checks further control supported actions such as viewing, editing, approving or administering records. An authorised person may belong to more than one company, but that relationship must be assigned.

These are application-level separation controls in a multi-tenant service. They should not be interpreted as a promise of a dedicated database or isolated hardware for each customer. Privileged platform and assigned support access are distinct from ordinary customer access and must be used for legitimate administration and support.

Authentication establishes which account is making a request. Authorisation then determines which company, records and actions that account may access. These are separate controls: being signed in does not itself grant administrative, approval or cross-company authority.

Supported web and mobile sign-in workflows check account state and current credentials. Accounts using two-factor authentication must complete the applicable additional challenge. Temporary or reset credentials can require the user to choose a private password before continuing.

Credential-state checks support rejecting access based on outdated credentials or an inactive account. Mobile sign-out removes the current access token through its supported logout workflow. The effect of a particular reset or access change should be checked in the relevant administration process, especially for a person working across several companies.

A change to application access does not remotely retrieve a document already downloaded, remove information from an external recipient or physically wipe a phone. Customers should combine account administration with their device, staff-departure and document-handling processes.

Customer files are held in private cloud object storage configured to block public bucket access and encrypt stored objects using AES-256 server-side encryption. File versioning supports the preservation of previous object versions.

The platform uses HTTPS for web and API communications. Authorised file operations can use time-limited signed storage links. These grant a specific operation for a limited period; possession of an active link may allow that operation, so links should be handled as confidential.

A file downloaded, printed or forwarded by an authorised recipient becomes a copy outside the platform’s access controls. Customers must protect those copies themselves. Application deletion and physical removal of historical storage versions are different operations; the retention section explains that distinction.

Some workflows deliberately allow an external person to act without a ShieldIQ account. Examples include selected document sharing, auditor access, appointment or document signatures, visitor induction, meeting invitations and customer feedback. Each exposes the information and actions defined by that particular workflow.

A bearer link works because the recipient possesses the link. It is not an independent proof of the recipient’s identity and may be usable by someone to whom it is forwarded. Check both the intended recipient and the material exposed before distributing it. Links should not be posted in public channels or included in unrelated correspondence.

Link lifetimes are workflow-specific. A temporary file download, an expiring product-guide link and a document-signing invitation do not necessarily have the same expiry or revocation behaviour. Do not assume that all private links are one-time links or expire automatically.

A signature record shows the response and evidence captured by the workflow. The customer must determine whether the signatory had the necessary authority and whether the process meets the requirements of the particular document or transaction. Retain the associated version and any independently required identity or approval evidence.

• Use individual user accounts and assign access according to each person’s work. Review company memberships and remove unnecessary access promptly.
• Passwords are stored as one-way hashes. Two-factor authentication is supported in the applicable sign-in workflows; availability must not be confused with universal enrolment or enforcement.
• Keep account credentials, recovery methods, invitation links and external share links confidential. Report suspected compromise promptly.
• Protect phones and computers with device locks, supported software and appropriate organisational controls. Supported offline workflows can retain records and photographs locally until synchronisation.
• Check synchronisation before relying on a record being available to the wider team. Protect exported reports, email attachments and screenshots under your own information-handling rules.

Supported offline workflows can retain working data, photographs and pending actions on a device so a user can continue when connectivity is limited. Those local copies remain relevant to the customer’s information-protection responsibilities even if the server-side service uses private storage.

Synchronisation transmits queued work when a connection is available and the relevant account and company context permit it. A pending, failed or conflicting submission must not be treated as a confirmed server record. Users should review the available queue or conflict information and verify important submissions and attachments.

Camera, location, notification and file permissions support particular features. Location information may be included when a user submits a supported operational record; the presence of location fields should not be understood as a promise that every record is independently location-verified. Organisations should explain relevant collection to their personnel and configure device permissions appropriately.

Device locks, current software, access removal and control of local exports remain customer responsibilities. Do not infer a platform-wide remote-wipe service, a particular mobile-storage encryption guarantee or full offline availability from support for offline capture.

ShieldIQ uses AI assistance for supported tasks such as extracting information from documents, drafting checklists or text, suggesting controls and answering questions about available reference material. A request can include the relevant text, images, document content and context needed for the feature. Information is processed by an external AI service; it is not processed exclusively inside ShieldIQ’s own storage.

ShieldIQ uses only paid business API services for external AI processing. ShieldIQ does not use customer content to train shared foundation models. Under the AI supplier’s paid-service terms, submitted prompts, files and generated responses are not used to train or improve its models or products.

No-training protection is different from zero retention. The AI supplier may temporarily retain request and response information for service security, abuse prevention and required legal disclosures under its applicable terms. Limited processing retention does not grant permission to use customer content for model training under the paid-service terms.

AI output is assistance for a person to evaluate. It can contain errors, omissions or inappropriate suggestions. Authorised users remain responsible for checking source material, approving relevant changes and making safety, employment, legal and compliance decisions. AI assistance is not professional advice, certification or a clinical assessment.

No-training terms do not mean that uploaded material is anonymous or that personal information is automatically removed before processing. Submit the minimum appropriate material, check whether a whole document or selected content is relevant to the feature and avoid including unrelated sensitive information. A user must not treat a generated recommendation as an independently verified fact.

Temporary AI processing data is subject to the supplier’s applicable retention and deletion rules and is not intended to become a permanent customer archive. Supplier security records or legally required records may have separate retention rules. We do not describe all AI data as immediately erased, and do not apply a file-upload expiry period to every type of AI request.

Source documents uploaded to ShieldIQ, extracted text, saved suggestions, processing records and accepted results can remain in the customer’s workspace so that the service can function and users can review their work. Their retention follows the platform and customer-record rules, independently of temporary processing at the AI supplier.

A customer who requires an exact processing-retention limit, a particular processing location or zero-retention terms should obtain written confirmation of an appropriate service arrangement before submitting that information. Those requirements must not be inferred from the phrase “AI assistance”.

ShieldIQ uses service providers for cloud hosting and storage, document processing and AI, email and push notifications, and payment services. Relevant information may be passed to those providers to perform the requested function. Payment handling is described separately in the Privacy Policy and commercial terms.

Storage location and processing location are not necessarily the same. AI, messaging, support or other service processing may take place outside a customer’s country or the primary hosting region. This policy does not promise that all data stays in one country.

Customers may request the current provider information, applicable processing locations and data-processing terms through support@myshieldiq.com. Cross-border and regulated-data requirements should be addressed before that information is submitted. Applicable transfer safeguards and contractual obligations must be considered for the particular customer and processing activity.

Only the services used by the relevant feature are applicable. This table explains the categories of processing; customers can request the current named-provider information and relevant terms through the assurance process.

Retention follows the purpose of the record, the Privacy Policy, the applicable agreement and any legal preservation requirement. Removing a user account does not necessarily delete the organisation’s safety, employment or audit records to which that person contributed.

The published Privacy Policy provides a 30-day export window after subscription termination, followed by deletion subject to lawful retention. Customers should arrange export and confirm the applicable wind-down process before access ends. Available self-service exports depend on the module and format; contact support for requirements they do not cover.

A deletion request should identify the requesting organisation, the relevant account or records, the requester’s authority and the desired scope. State whether the request concerns a user login, particular personal details or termination of the organisation’s workspace. Necessary verification and any preservation exception should be resolved before a completion statement is relied on.

If confirmation is requested, it should distinguish removal from active use, any remaining historical or recovery copies, the reason and expected handling of an exception, and copies outside ShieldIQ’s control. This policy does not establish a universal deadline for physical erasure from every system or make a recovery-copy claim that has not been verified.

The service records relevant application events, processing activity and supported record changes to assist troubleshooting, traceability and review. These records may themselves contain personal or operational information and need appropriate handling.

Recovery arrangements and file versioning support continuity, but versioning is not a substitute for a verified backup and restore process. Exact backup frequency, retention, recovery-point and recovery-time commitments belong in the applicable service agreement. This document does not independently promise uninterrupted service, a particular recovery time or a certification status.

Security also depends on ongoing configuration, maintenance, access reviews and application changes. Cloud hosting and encryption reduce particular risks; neither eliminates the possibility of error, compromise or service interruption.

Platform administrators and support personnel may need authorised access to diagnose an issue, configure the service or assist a customer. Assigned support access and ordinary customer access are different. Support requests should identify the relevant company and record and should contain only the information needed to resolve the issue.

Where an authorised administrator assists in the context of another user, that capability must be treated as privileged access. Customers should not send passwords to make a support investigation possible. Permission to support a customer does not authorise unrelated reuse or disclosure of its records.

Application changes are maintained through the development and release process. Relevant checks should address access, workflow behaviour and the handling of information. This statement does not assert that every release has an independent penetration test, that every environment contains only synthetic data, or that a cloud provider’s certification automatically certifies ShieldIQ.

For a technical assessment, request evidence appropriate to the requirement: the relevant access arrangement, hosting or processing location, database protection, backup and restore arrangements, retention procedure or supplier terms. A general product description is not a substitute for evidence of a particular control operating in the production environment.

Report suspected unauthorised access, exposed information or a security weakness to security@myshieldiq.com. Include enough information to identify the issue, but do not send passwords, secret keys or unnecessary sensitive records.

In line with the Privacy Policy, ShieldIQ will take reasonable steps to contain and investigate a confirmed compromise and notify affected customers without undue delay, subject to applicable law. Information provided should support the customer’s assessment of the incident and its own notification duties as facts become available.

Where ShieldIQ processes information for an organisation, that organisation remains responsible for its own decisions and obligations towards affected people and regulators. Specific incident communication commitments may be agreed in the service or data-processing agreement.

A useful report identifies the affected company or account, the observed issue, the approximate time and the information that may be involved. Preserve relevant evidence without unnecessarily reproducing sensitive records. Notifications may need to be updated as an investigation establishes scope, impact and corrective measures; initial uncertainty should not be represented as a final conclusion.

Customers are responsible for a lawful basis to submit personal information, giving appropriate notices to staff and other people, configuring access, checking AI-assisted results and setting record-retention requirements suitable for their operations. Sensitive health or identity information requires particular care.

Requests for access, correction, restriction or deletion should be directed to the organisation controlling the relevant record or to support@myshieldiq.com. ShieldIQ may verify identity and authority and refer a request to the relevant customer. Applicable legal rights, exceptions and response periods govern the request.

For supplier assessments, customers can request further information under appropriate confidentiality arrangements. We can discuss relevant controls without publishing credentials, internal network details or other material that could undermine security.

Neither party should assume that the other has completed an action merely because a feature is available. Responsibilities, evidence requirements and any stricter service commitments should be agreed explicitly.

Business Risk Solutions Namibia CC owns this document. The version and review date identify the statement you are reading. The policy should be reviewed when material functionality, providers, infrastructure or data-handling practices change, and as part of regular policy review.

The current version is published on this page. Material changes will be communicated where required by the applicable agreement or law. A printed or downloaded copy is a snapshot; check the online version when relying on it for a new assessment.