Public Guide

What Data BlackShield Uses, Stores, and Shares

Understand exactly which record categories exist in the workspace, which ones appear in tenant-admin screens, and which legal documents cover processor and privacy commitments. Audience: Security buyers, legal teams, privacy teams, and procurement stakeholders. Typical setup time: 10-15 minutes.

trust

Use this if

Understand exactly which record categories exist in the workspace, which ones appear in tenant-admin screens, and which legal documents cover processor and privacy commitments.

Audience: Security buyers, legal teams, privacy teams, and procurement stakeholdersTypical time: 10-15 minutes

Before You Begin

  • Prepare your internal data-classification policy and vendor review checklist.
  • List the systems, scanners, and integrations that will send data to BlackShield.
  • Have `/tenant-rights` open so the current workspace data categories are visible during the review.

Guide walkthrough

1

Step 1

Identify core data categories and multi-region storage residency

The platform stores finding metadata, triage states, and user accounts in isolated per-tenant SQLite partitions.

  • In `/tenant-rights`, BlackShield tallies users, API keys, findings, remediation records, audit logs, and external assets.
  • Designated AWS home region (`us-east-1` primary, `eu-west-1` Ireland, or `eu-central-1` Frankfurt) guarantees strict regional data residency.
  • Multi-cloud network sensors inspect traffic within customer VPCs (AWS, GCP, Azure) with zero raw payload egress.
  • Sensitive scanner metadata and custom tags remain under customer tenant control and can be excluded before ingestion.

What success looks like

Sensitive scanner metadata and custom tags remain under customer tenant control and can be excluded before ingestion.

2

Step 2

Review authorized platform subprocessors and AI Gateway BYOK connections

Vetted third-party providers deliver hosting, email, billing, AI inference proxying, and alerting under strict DPAs.

  • Core subprocessors: AWS (compute & S3 SQLite storage), Stripe (billing), Resend (transactional email), Google LLC (analytics with Consent Mode v2), and Slack (support).
  • Customer-configured AI Gateway connections: OpenAI, Anthropic, Azure OpenAI, Google AI Studio, Groq, and Mistral AI operate under customer BYOK credentials with zero training on customer data.
  • Customer-configured alerting and ticketing integrations: Atlassian (Jira), GitHub, Inc. (GitHub Issues), and Microsoft Corporation (Microsoft Teams) dispatch alerts only to customer-authorized channels.

What success looks like

Customer-configured alerting and ticketing integrations: Atlassian (Jira), GitHub, Inc. (GitHub Issues), and Microsoft Corporation (Microsoft Teams) dispatch alerts only to customer-authorized channels.

3

Step 3

Audit customer alerting integrations and tenant deletion

Third-party integrations and offboarding workflows remain strictly customer-authorized and reversible before deletion.

  • Tenant deletion permanently purges all users, finding records, API keys, audit logs, ingestion state, and database partitions.
  • Deletion requires a typed confirmation phrase tied to the workspace slug plus an irreversible-action acknowledgement.
  • Export compliance audit logs and executive reports before executing irreversible deletion in `/tenant-rights`.

What success looks like

Export compliance audit logs and executive reports before executing irreversible deletion in `/tenant-rights`.

What success looks like

  • Your team can point to the actual workspace record categories BlackShield stores today.
  • Processor, transfer, and privacy questions are separated cleanly from product-visible data scope.
What Data BlackShield Uses, Stores, and Shares | BlackShield Docs