Designed so sensitive data has fewer places to hide.
Shield separates public delivery, authenticated APIs, private storage, encrypted secrets, background processing, and audit evidence so a single browser request cannot silently cross every boundary.
Treat the server session as the authority.
Verified Firebase identity is exchanged for an HTTP-only session. Account and role decisions are resolved on the backend; App Check and rate limits add protection at the API boundary.
Encrypt values that must persist.
Identity-vault data, Gmail credentials, provider keys, request drafts, and file-redaction selections use account-scoped envelope encryption backed by Cloud KMS. Private objects use short-lived signed URLs.
Make the durable record useful without copying the source.
Governance reports retain masked findings, hashes, timestamps, versions, decisions, and integrity signals. Raw conversation content is excluded from the permanent report.
Verify every release path.
The delivery workflow runs type checks, automated tests, dependency audit, secret scanning, infrastructure validation, container vulnerability scanning, SBOM generation, and staging smoke checks.
Before you start
Are AI provider keys returned to the browser?
No. After connection, Shield returns only provider status and a non-sensitive key hint.
Are uploaded files public?
No. Upload and download access use private account-scoped objects and expiring signed URLs.
What is recorded in an audit event?
Operational events record the actor, action, time, relevant identifiers, and chained integrity metadata—not a new raw copy of the sensitive source.
Use the workflow without giving up visibility.
Start with a source you control and inspect the evidence record Shield creates.