Security
How Shoot protects your team's data
Shoot handles screenshots, webcam audits and activity data, so we keep it encrypted, private by default and visible only to the people you choose.
Where Shoot runs
Shoot is hosted on Amazon Web Services in the US East (N. Virginia) region:
- Amazon ECS for the application servers
- Amazon RDS (MySQL) for the database
- Amazon ElastiCache (Redis) for sessions and queues
- Amazon S3 for screenshots, webcam audits and files
- Amazon CloudFront for the web app
- Amazon SES for email
Encryption
- All traffic between your browser or the desktop app and Shoot uses HTTPS with TLS 1.2 or higher.
- The production database is encrypted at rest with AES-256 through AWS KMS.
- Screenshots, webcam audits and files are stored in Amazon S3 with AES-256 server-side encryption.
- The Redis cache is encrypted at rest and in transit, and the database connection uses TLS.
Who can see what
- Captures are never public. The storage bucket blocks all public access, and the app shows each image through a short-lived signed link.
- Role-based access control: managers see their own teams, and custom roles let you decide exactly which screens each role can open.
- Workspace admins can require two-factor authentication with an authenticator app for every member.
- An activity log records sign-ins and who viewed screenshots or exported timesheets, so admins can review access.
Accounts and sign-in
- Passwords are stored only as salted bcrypt hashes.
- Repeated failed sign-in attempts are rate limited.
- New accounts confirm their email address with a one-time code before they can sign in.
Reliability
- The database is backed up automatically every day, and backups are kept for 7 days.
- Infrastructure runs in a private AWS network; the database and cache are not reachable from the internet.
Subprocessors
These companies process customer data on our behalf.
| Company | What for | Location |
|---|---|---|
| Amazon Web Services | Hosting, database, file storage and email | United States |
| Stripe | Payments and billing | United States |
| Maps, geocoding and time zones for location features; Google sign-in | United States | |
| New Relic | Application monitoring and error logs | United States |
Report a vulnerability
If you think you have found a security problem in Shoot, email security@trustshoot.com with the details and how to reproduce it. Please give us a chance to fix it before telling anyone else, and don’t access or change other customers’ data while testing.
Frequently asked questions
Does Shoot record keystrokes?
No. Shoot measures whether the keyboard and mouse are active so it can tell work time from idle time, but it does not record which keys are pressed or what is typed.
Can my employees see what is captured about them?
Yes. Members can see their own timesheets, activity and screenshots in the app, and admins decide how often screenshots and webcam audits are taken, or turn them off.
Where is my data stored?
In Amazon Web Services, in the US East (N. Virginia) region.
Will you sign a Business Associate Agreement?
Yes, for workspaces on the Professional or Enterprise plan. See the HIPAA page for how to request one.
Last reviewed November 5, 2026.