Shebaka Privacy
Privacy.
What we collect, why, where it lives, who else processes it, how long we keep it, and how to get it deleted. Written to be read rather than to cover us, with the specifics — because a cloud whose supply chain you can read should have a privacy page you can read too.
The short version
We collect what it takes to run your account and bill you, nothing to advertise to you, and we do not sell or share data with anyone who is not doing work for us. Your applications' data is yours; we host it, we do not read it.
- No advertising, no trackers. This site sets no cookies and loads nothing from advertising or analytics networks. The console uses one session cookie so you stay signed in.
- Your workloads are yours. Code, images, databases, volumes, logs and environment variables belong to you. We access them only to operate the platform, for support you ask for, or when required by law — and we say so below.
- We know where everything is. Every machine holding your data is on our provenance record: who owns it and under whose law it sits.
- Delete means delete. Closing your account removes your workloads and account record; the backups they were in expire on their schedule, stated below.
What we collect, and why
Grouped by where it comes from. If something is not listed here, we are not collecting it.
Your account
Your email address and, if you give one, your name and organisation. Sign-in is by a one-time link sent to that address, or by single sign-on through an identity provider you choose. We keep a record of how each session was established, and an API key you can rotate. We use this to know who you are, to reach you about your account, and to attribute what you run to the account that pays for it.
Billing
Usage metered per account — node-hours, vCPU and memory hours, storage gigabyte-months, inference tokens — and the statements built from it. Card details are handled by Stripe; we store Stripe's reference to your payment method, never the card number. We keep statements for as long as tax and accounting law requires, which is longer than the account itself.
What you deploy
Source code you connect, the container images we build from it, environment variables (including ones you mark secret, which are encrypted at rest in our registry and only ever delivered to your workload), managed database contents, volumes, and build and application logs. We process these only to build, run, back up and restore your applications. We do not read application data or logs except to diagnose a problem you have asked us to look at, or where a legal obligation or an abuse complaint requires it — and in that case the access is written to an audit log.
Operating the edge
Every request to an application we host passes through our edge. The edge log records the hostname, method, path, status and timing of the request and which cluster served it, so we can operate and bill the platform. It does not record your visitors' IP addresses. Sign-up and build requests are rate-limited per source address; those counters live in memory and are gone within the hour.
Private clusters and single sign-on
On a private cluster, every application hostname requires a sign-in through Google before anything is served. When a visitor signs in we receive from Google their email address, name, and the Google Workspace domain the account belongs to; we check that domain against the allowlist the cluster's owner configured, and if it matches we set a signed cookie on that application's hostname for up to 12 hours and pass the visitor's email address to the application as a request header. We store the visitor's email in the audit log alongside the sign-in event and any refusal; we do not build profiles, and we do not use Google data for anything else. Removing a domain from the allowlist ends every session from it on the next request.
The audit log
Actions that change the shape of your account or the platform — deploys, deletions, key rotations, allowlist changes, operator access, sign-ins to private clusters — are appended to an audit log with who did it and when. It exists so that "who changed this" always has an answer, including when the answer is us.
Support and email
If you write to us, we keep the correspondence. Transactional email — sign-in links, invoices, receipts, spend-cap warnings — is sent for us by Resend.
Where it lives, and who else touches it
We run on machines from providers who have passed a written ownership and jurisdiction screen, and we use a small number of services for things we do not build ourselves. Each is here, with what it sees.
Infrastructure
Your workloads, their backups and our own records run on servers and object storage at the providers listed on the provenance record, in the region you chose when you deployed. Off-node backups are encrypted and stored in object storage in the same screened set of providers. Nothing is replicated to a region you did not choose, except a disaster-recovery standby you enabled yourself.
Processors
- Stripe — payments. Sees your email, billing details and card; we see a reference and the last four digits.
- Resend — transactional email. Sees your email address and the message.
- Zitadel — optional single sign-on to the console. Sees your email and name when you choose that method.
- Google — sign-in to applications on private clusters. Sees that you are signing in to Shebaka; we receive your email, name and Workspace domain.
- Better Stack — uptime and heartbeat monitoring of our own services. Sees nothing about you.
We have no advertising, analytics or data-broker relationships, and we do not sell data. We disclose data to a third party only to these processors, with your instruction, or when a valid legal demand from a jurisdiction that governs us requires it — in which case we tell you unless we are legally prevented from doing so.
How long we keep it
Retention is a number, not a sentiment. These are the numbers.
- Account record — for the life of the account, then removed when you close it.
- Workloads, databases, volumes — until you delete them or close the account; deletion is immediate on the cluster.
- Database backups — nightly dumps kept for 7 days; off-node base backups and write-ahead logs on a rolling window, and removed within 30 days of the database being deleted.
- Our own state backups (the registries that include your account record) — 30 days, encrypted.
- Build logs — 30 days.
- Edge and audit logs — 90 days; audit entries that are part of the billing or security record are kept with the statements they concern.
- Statements and invoices — 7 years, as accounting law requires.
- Private-cluster sign-in cookies — 12 hours, or until the allowlist changes, whichever is first.
Your rights, and how to use them
Access, correction, export, deletion, objection — you have them wherever you are, not only where the law makes us grant them.
Write to privacy@shebaka.com from the address on your account. We answer within 30 days; most requests are done the same week. Most of it you can do yourself: the console lets you export your data, rotate keys, delete workloads and close the account. If you believe we have handled your data wrongly you can complain to the supervisory authority where you live; we would rather hear from you first, and we will not treat a complaint as a reason to treat you differently.
Children
Shebaka is a service for organisations and developers. We do not knowingly hold an account for anyone under 16; if we learn that we do, we close it.
Changes to this page
When this page changes we update the effective date above and, for anything that widens what we collect or who we share it with, email every account holder before it takes effect. The history of this page is in our public source repository.