Security you can explain to an auditor
Your compliance record holds your organisation's policies, incidents and people's information. Here is how made. Shield keeps it private, keeps it accurate, and keeps a person accountable for everything that's issued. Answering a security questionnaire? Start here, then ask us.
A workspace that's yours alone
A governance engine in its own isolated workspace for each organisation. Your programmes, library and reports have their own storage, separate from every other customer's.
Built on Cloudflare
made. Shield runs on Cloudflare, one of the world's largest networks. Encryption, protection against attack and constant monitoring come built in.
No passwords to leak
People sign in with a one-time code sent to their work email. Only the people your organisation adds can open its workspace, and your administrators decide who that is and what access each person has.
The AI drafts. A named person issues.
The assistant reads, proposes and drafts. People confirm evidence and set statuses, and a named person issues every report as a digitally certified PDF, optionally with a second approver.
An evidence trail that shows any change
Every evidence link, status change, finding, action and report is recorded in order, and any later change to an earlier entry shows. Each issued report is anchored to the trail when it is issued.
Your records, untouched
Source documents are kept exactly as they arrived. Every evidence link points to the exact version and passage it relies on, so a later revision never blurs what a finding was based on.
Sensitive records handled carefully
Flag a document as personal or sensitive and it is withheld from board views and from the read API by default. The evidence trail never copies personal information into itself.
Read-only access for directors
Board members can see posture, programmes, findings, actions and issued reports, but not drafts, working notes or personal information, and can't change anything.
AI you don't have to manage
The built-in assistant runs on AI models hosted on Cloudflare's network, chosen and kept up to date by us. We don't use your content to train AI models.
Bring your own assistant
Your team can connect Claude, Microsoft 365 Copilot or Codex. Those conversations run under the account each person connects, and a connected assistant can draft and propose but can't confirm evidence or issue a report.
Where your data is processed
made. Shield runs on Cloudflare's global network. Processing isn't limited to Australia, and the Privacy Policy sets out who helps us provide the service and where.
The Privacy Policy sets out exactly what we collect, who helps us provide the service and where data is processed, including outside Australia, and our sub-processors are listed in one place. The Acceptable Use Policy describes how the service protects your organisation's content. The help centre inside made. Shield explains precisely how the evidence trail is built and checked. To report a security concern or ask for data processing terms, contact our team.
Security questions
What is made. Shield's evidence trail?
made. Shield keeps a tamper-evident evidence trail for every programme: each evidence link, status change, finding, action and report is recorded in order, and any later change to an earlier entry shows.
Every issued report is anchored to the trail at the moment it was issued, so an auditor can check that nothing behind it was changed afterwards. The trail records what happened and who did it, without copying personal information into it.
How can an auditor check a made. Shield report?
An auditor can check a made. Shield report's digital certification in any PDF reader, and check its evidence trail with the evidence pack you give them, without signing in.
Members of your organisation can also verify any issued report inside Shield by its reference or by uploading the file.
Is our data private in made. Shield?
Yes. Each made. Shield organisation has its own isolated workspace, with its own storage, separate from every other customer's.
Only the people your organisation adds can open it, and every visit by our support team is recorded in your own activity record.
Where is made. Shield data processed?
made. Shield runs on Cloudflare's global network. Processing isn't limited to Australia, and the Privacy Policy sets out who helps us provide the service and where.
Our sub-processors page lists every provider in one place.
Does made. Shield use our content to train AI?
No. We don't use your content to train AI models. made. Shield's built-in assistant runs on models hosted on Cloudflare's network, chosen and kept up to date by us.
If your team connects Claude, Copilot or Codex, what they read through that connection goes to that provider under the account each person connects.
How do people sign in to made. Shield?
People sign in to made. Shield with a one-time code sent to their work email: there are no passwords to leak.
Only the people your administrators add can open your organisation's workspace.
Can made. Shield hold incident and HR records?
Yes. made. Shield can hold incident reports, HR records and other documents with personal information, and a person can flag a document as personal or sensitive.
Flagged documents are withheld from board members' views and from the read API by default, and administrators decide whether exports include them.