Secure by
architecture.
Choose where your data lives. Control who sees it. Know exactly what changed and when. Security isn't a feature we bolted on — it's how the platform is built.
Your work stays your work
You are in control. Every layer of the platform is designed to protect your code, your data, and your customers.
EU sovereignty
Your code and data run on 100% EU-owned infrastructure via Scaleway. No US parent company, no Cloud Act exposure.
- 100% EU-owned infrastructure
- Data never leaves EU jurisdiction
- No US Cloud Act exposure
- European infrastructure providers
Access control
Role-based permissions enforced at the platform level. SSO/SAML for enterprise identity providers.
- SSO / SAML integration
- Role-based access per app
- Per-app environment isolation
- Platform-level auth
Security scanning
Automated vulnerability scanning runs on every release in the CI/CD pipeline.
- Scanning on every build
- Dependency audits
- Browser-based testing
- Dev / prod separation
Compliance & audit
Full audit trail on every release. Git history plus platform-level audit events. Available on all plans.
- Audit trails on all plans
- Full Git history per app
- GDPR compliant by default
- ISO 27001 in progress
Secrets management
Environment variables and secrets encrypted at rest, scoped per app. Never exposed in logs or diffs.
- Encrypted at rest
- Scoped per app
- Never in logs or diffs
- Rotatable without redeploy
Infrastructure protection
Every app runs in its own isolated container. Network policies prevent cross-app access.
- Container isolation per app
- Network policy enforcement
- Automated patching
- Managed infrastructure
Data residency: EU only.
Unlike US-based platforms that offer EU as an option, Shaep is EU-only by design. Next Epoch B.V. is a Dutch company. Scaleway is French. There is no US parent.
Infrastructure
Scaleway, France
Legal entity
Next Epoch B.V., Netherlands
Code hosting
Self-hosted Forgejo, EU
Frequently asked questions
Where does my data live? +
All data is stored and processed on EU-owned infrastructure operated by Scaleway. Data never leaves EU jurisdiction.
Is Shaep subject to the US Cloud Act? +
No. Shaep is operated by Next Epoch B.V., a Dutch company. Our infrastructure provider Scaleway is French. There is no US parent company.
Do you train AI models on my code or data? +
No. Your code and data are never used for model training. When you bring your own AI model, the connection is direct between your editor and your chosen provider.
What happens if there's a security incident? +
We maintain an incident response process with defined escalation paths. Affected customers are notified within 72 hours as required by GDPR.
Can I get a DPA? +
Yes. Contact us and we'll provide a Data Processing Agreement tailored to your organization.
Do you support SSO with my identity provider? +
Yes. We support SAML and OIDC-based SSO. Okta, Azure AD, Google Workspace, and other providers work out of the box.
Need more detail?
We'll walk through our security architecture, provide a DPA, or answer specific compliance questions.