How Shomerli protects your data — without halakhic compromise.

Your data, in plain terms.

No technical jargon. For parents who want the essentials before signing up their household.

Technical whitepaper.

Architecture, encryption, honest hosting topology, API controls, bypass detection. All claims independently verifiable.

B.1 — Multi-layer architecture

Shomerli is not a standalone DNS filter. It's a multi-layer architecture designed for the observant community, where each layer adds a distinct protection. No single layer is sufficient — it's their composition that makes bypass expensive and detection fast.

B.2 — Where your data lives.

Shomerli was designed and operates from Montreal. Our commitment is Canadian residency for all sensitive data. Here is the current state — and our public roadmap. No "100% Canadian infrastructure" claim that an IT auditor would dismantle in three minutes.

B.3 — Encryption, end to end.

# Test our SSL grade publicly:
$ curl -I https://shomerli.com
HTTP/2 200
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
x-frame-options: DENY

You can independently verify our TLS configuration via SSL Labs or Mozilla Observatory.

B.4 — API layers & access control

• ·RBAC. 5 strict roles (SUPER_ADMIN, ORG_ADMIN, PARENT, MEMBER, CHILD). Hierarchy enforced server-side in tRPC middleware, checked on every call.
• ·Rate limiting. Redis-based, per IP + per user + per endpoint. Progressive backoff. CAPTCHA after 3 consecutive failures.
• ·Input validation. Zod schemas client- and server-side. HTML sanitization. Prisma parameterized queries (SQL-injection-safe).
• ·CORS. Strict origins — dashboard domain + mobile app scheme only.
• ·CSP. Strict Content Security Policy (script-src 'self', style-src 'self' + Tailwind, img-src 'self' + CDN).
• ·Dependency scanning. Snyk + npm audit in CI/CD. Zero-CRITICAL-vuln policy: no CRITICAL vulnerability in production without a hotfix within 48 hours.
• ·Audit trail. Immutable append-only PostgreSQL table. Action / user / timestamp / IP / metadata for every security-relevant event. 90-day hot retention, 7-year cold archive.

B.5 — Bypass detection.

Part of Shomerli's value is its resistance to bypass — VPN, proxy, alternative DoH. We can't catch everything; here is what we do technically:

• ✓VPN connection detection (Knox API, kernel-level mode planned post-activation)
• ✓DoH / DoT detection toward non-Shomerli servers
• ✓HTTP(S) proxy configuration detection
• ✓SSL pinning bypass attempt detection
• ✓Real-time notifications to the household or school admin
• ✓Attempt logs that don't reveal user identity (privacy-first default)
• ⚠No filtering system is 100% bypass-proof. A determined user with root access on a device can circumvent. Our approach: raise the effort cost + detect quickly.

B.6 — Immutable audit trail.

All security events (login, password change, RBAC change, data export, deletion) are logged into an append-only PostgreSQL table. No UPDATE or DELETE permitted. Enforced via DB constraints + automated tests.

-- Audit log structure (simplified):
CREATE TABLE audit_log (
  id UUID PRIMARY KEY,
  user_id UUID NOT NULL,
  action VARCHAR(100) NOT NULL,
  resource_type VARCHAR(50),
  resource_id UUID,
  ip_address INET,
  user_agent TEXT,
  metadata JSONB,
  created_at TIMESTAMPTZ DEFAULT NOW()
);
-- No UPDATE or DELETE permissions granted

B2B and halakhic compliance.

Regulatory frameworks, named Privacy Officer, incident response plan, and contractual commitments — all auditable on request.

C.1 — Compliance frameworks

All claims are auditable. On request for rabbis or Vaad lawyers: full internal documentation (DPIA, RoPA, incident response plan).

C.2 — Privacy Officer & contacts

Article 3.2 of Quebec's Law 25 requires any organization collecting personal data to designate a person responsible for privacy protection. For Shomerli that is our founder — until the team grows enough to formalize an independent DPO.

C.3 — Incident response

In the event of a breach or security incident, the following process applies — each step with an explicit SLA, logged into the audit trail:

1. 01

   Containment< 1 h

   Isolate affected systems. Revoke potentially compromised credentials. Preserve forensic snapshot.

2. 02

   Investigation< 24 h

   Forensic analysis, breach scope, identification of affected data and impacted users.

3. 03

   User notification< 72 h

   Email to every potentially affected user (PIPEDA + Law 25 art. 3.5). Incident details, data touched, recommended actions.

4. 04

   Authority notification< 72 h

   CAI Quebec if required by Law 25 art. 3.5. Office of the Privacy Commissioner of Canada if applicable.

5. 05

   Public post-mortem< 14 d

   Published at /security#incidents — transparency commitment. Timeline, root cause, corrective measures.

No security incident has occurred to date (Shomerli is 4 months old). If one did, this process would be followed and this page updated publicly with a post-mortem.

C.5 — Contractual commitments

• ✓No sale of data to advertisers or commercial third parties.
• ✓No advertising profiling — no audience building, no look-alike modeling.
• ✓No use of data to train third-party AI models. Data stays inside Shomerli + Anthropic API with PII redaction.
• ✓Full deletion on request, under 72 hours (legal limit 30 days, Law 25).
• ✓Full export on request, under 72 hours, portable JSON format.
• ✓30-day notice before any change to the privacy policy (Law 25 art. 8.2).

Want to verify our claims?

Public roadmap