Shield360 › For Compliance
An auditor does not
accept a dashboard.
They ask who looked at what, on which date, under whose authority, and how long the record is kept. Those are database questions. Shield360 is built so that each of them has an answer that can be exported, rather than a screen that can be described.
01 · Overview
Stopped, held, read, kept
Four questions, one screen.
What is being stopped, what is held, who looked at what, and how long it is kept. The compliance overview is deliberately not a summary of the other screens — it is the four answers themselves, with the current posture stated in words beside each.
02 · Audit
Reads, not only writes
Most audit logs record changes.
The question is usually about a read.
“Who looked at this?” is the question that arrives with a subject access request, an internal investigation or a regulator's letter — and it is the one most systems cannot answer, because reads are not events in them. In Shield360 they are.
Table view
| Category | Records in the quarter |
|---|---|
| Data access · reads of sensitive data | 4,860 |
| Sign-ins · succeeded and failed | 2,310 |
| Changes · settings, roles, keys, holds | 1,240 |
| Denied · refused for lack of access | 96 |
| Category | Records | Example |
|---|---|---|
| Changes | Writes | A setting altered, a role granted, a key created or destroyed — with who did it and whether it succeeded. |
| Data access | Reads | “Viewed the AI spend report”, “Viewed sensitive-data findings”, “Viewed the Data protection report”. |
| Sign-ins | Auth | Successful and failed attempts alike. A failed attempt is filed in the organization of the account it targeted, so that organization's admins see it. The password is never recorded. |
| Denied | Refusals | A request refused for lack of access. An access control that does not record its refusals cannot be shown to be working. |
03 · Retention
Enforced by the engine
Retention that actually runs.
A retention policy in a document is a statement of intent. Here every collector table carries a time-to-live enforced by the storage engine itself: when the horizon passes, the rows are gone — not flagged, not queued for a quarterly review that slips.
| Record | Kept for | What it contains |
|---|---|---|
| AI usage | 730 days | Responses, tokens and cost per tool, model and person. |
| AI output sessions | 730 days | What an AI session produced, by repository and tool. |
| Data protection events | 7 years | Every block, redaction and warning, with its rule and outcome. The longest horizon, because it is the one most likely to be asked for years later. |
| Application activity | 365 days | Which application was in front, and for how long. No window titles, no file names. |
| Network observations | 365 days | Processes seen reaching AI providers directly. Off until enabled. |
| Application spans | 90 days | The fine-grained slices behind application time. |
| Machine state | 90 days | Awake, asleep, locked. |
| Browsing visits | 30 days | Registrable domain unless explicitly widened. Off until enabled. No page titles. |
| Collector heartbeats | 30 days | Which machines are reporting, and which stopped. |
| Audit log | Indefinite | Never edited. Removed only if the organization itself is deleted. |
| Under legal hold | Until released | Preserved past every horizon above. |
04 · Legal hold
Preservation that outranks deletion
A hold has to beat the
retention job, or it is decoration.
When a matter arises, the records that matter are the ones about to expire. A legal hold in Shield360 names custodians — the people and the computers involved — and preserves their AI usage, activity, websites and data protection events past every horizon on this page until the hold is released.
Preserved hourly
A scheduled job re-preserves held records rather than relying on a single sweep at the moment the hold was placed. Records that arrive after the hold is in force are caught too.
Cannot be deleted, only released
There is no path that removes a hold as though it had never existed. Releasing one requires a reason, and placing, preserving, exporting and releasing are all recorded in the audit log.
Evidence export
Data protection events export as CSV for any window and any filter, so a matter can be handed over as a file rather than as access to a console.
05 · Boundaries
Schema, not settings
The limits are built in,
not left to a setting.
A privacy commitment that depends on a setting is a commitment that survives until somebody changes the setting. These are properties of the database: there is no column to populate, so there is no configuration that could start populating it.
06 · Questions
Asked in an assessment
What an assessment asks.
Can Shield360 be deployed without personal data leaving our jurisdiction?
Yes. Self-hosted deployment runs entirely within your own infrastructure, including air-gapped, with no call-home requirement. Nothing passes through our systems.
Is this a certification?
No, and it should not be described as one. Shield360 produces the evidence an auditor asks for — control status for all 38 ISO/IEC 42001 Annex A controls with a Statement of Applicability, an audit log, enforced retention, holds, and signed evidence packages an auditor can verify offline. The attestation is still yours to obtain.
How do we answer a subject access request?
Reporting narrows to an individual, and every record about them carries the horizon on which it expires. Because you are the controller, the request comes to you; the product's job is to make the answer retrievable and the deletion horizon demonstrable.
What happens to held data when the matter ends?
The hold is released with a reason, which is recorded. The records then resume the retention horizon they would otherwise have had, and expire on it.
Can an administrator widen collection without a record?
They can change the organization's policy, and the change is recorded in the audit log as a change event with an actor. What they cannot do is raise collection for one named individual above the organization's level — that is not expressible.
Does the audit log itself get audited?
Reads of it are recorded in it. Opening the audit log is a data access event like any other read of sensitive data.
Put it in front of your auditor.
The fastest way to assess this is to bring the questionnaire you already send to vendors, and go through it on the screens.