Security page: implemented, not aspirational

shipyu.com/security documents how Shipyu handles API keys, webhooks, and your data. Every claim on it describes what is implemented today — no roadmap items, no aspirations.

• API keys stored as SHA-256 hashes and compared in constant time; keys are shown once at creation
• Webhooks signed with HMAC-SHA256 secrets so your endpoint can verify every delivery; secrets are shown once and rotatable
• Credentials redacted from stored request bodies; 90-day retention with automatic cleanup
• Two-factor authentication and organization-scoped roles in the console

The page also lists every subprocessor and how to report a vulnerability.