ShapeBlock stores the cloud provider API keys so that it can use the keys to provision resources in your cloud provider. These keys are encrypted both at rest and in flight.
Payment information is not stored in ShapeBlock servers and is handled by Stripe.
ShapeBlock uses your Github/Gitlab access tokens(if you furnish them) to deploy apps based on private repositories. This code is only stored in your servers and not in ShapeBlock.
Any data associated with your app is also not stored by ShapeBlock. It is only stored on your own servers.
Contact support if you have any questions around security or want to report a possible security breach.