Customer portal

Shield360 Enterprise customers who run Shield360 in their own network use the customer portal at portal.shield360.ai. In the portal you can:

download the self-hosted images and get a registry login,
register each install and generate its licence,
open support tickets and follow them.

The portal has its own accounts. An account in the Shield360 cloud app (app.shield360.ai) does not sign you in to the portal, and a portal account does not sign you in to the cloud app.

Shield360 invites your first owner by email. Open the invitation link, then either set a password or leave the password empty and sign in with emailed links. An invitation works once, for 7 days.

Request access

If you have no invitation, choose Request access on the sign-in page and give your name, work email, company and, if you like, a short message. Every request gets the same answer: “Thanks, we’ll be in touch.” Shield360 reviews requests by hand. No account is created until a Shield360 administrator approves yours; then you get the usual invitation email. If your company already uses the portal, ask one of its owners to invite you under Team instead.

To sign in later, go to portal.shield360.ai and choose one of these:

Email and password.
Email me a sign-in link. The link works once, for 15 minutes.

If you forget your password, choose Forgot your password?. The reset link works once, for an hour. Setting a new password signs you out on every other browser.

Roles

Role	Can
Owner	Everything a member can, plus invite people, change their role and disable them.
Member	Download, register deployments, generate licences, and open and answer tickets.

Owners manage people under Team. You cannot change your own role, and every customer keeps at least one active owner.

Single sign-on

Your people can sign in to the portal through your company’s identity provider (Microsoft Entra ID, Okta, Google Workspace, Ping, Keycloak and others), over SAML 2.0 or OpenID Connect. Shield360 support sets it up with your IT team. Owners can see the status under Team → Single sign-on.

To sign in, choose Sign in with your company, enter your work email, and finish signing in at your identity provider. The portal finds your company from the email’s domain.

Set it up (for your IT team)

Open a support ticket asking for single sign-on, and say whether you use SAML 2.0 or OpenID Connect.

Shield360 sends you your portal’s addresses. Each customer has its own.

Protocol	What you enter at your identity provider
SAML 2.0	Entity ID (audience): `https://portal.shield360.ai/api/portal/sso/<your id>/saml/metadata` ACS (reply) URL: `https://portal.shield360.ai/api/portal/sso/<your id>/saml/acs` Or import the metadata from the entity ID URL.
OpenID Connect	Redirect URI: `https://portal.shield360.ai/api/portal/sso/<your id>/oidc/callback` Use the authorization code flow. The portal sends a PKCE challenge (S256) and authenticates to the token endpoint with the client secret (HTTP Basic).

Send Shield360 what your identity provider gives you back:
- SAML: your IdP metadata URL or document. If you have neither, send the IdP entity ID, the sign-in URL (HTTP-Redirect binding) and the signing certificate.
- OpenID Connect: the issuer URL, the client ID and the client secret. Send the secret through the ticket. Shield360 stores it encrypted and never shows it again.
Prove that you own your email domains. For each domain, publish the TXT record Shield360 gives you on the domain itself, for example:
```
acme.com.  TXT  "shield360-domain-verification=…"
```
Single sign-on signs in addresses on verified domains only.
Test with the sign-in link Shield360 sends you, then ask for it to be turned on.

What the portal needs in the sign-in response:

SAML: the assertion must be signed (SHA-256), and must carry the person’s email in an email attribute or as the NameID. Sign-in must start at the portal; IdP-initiated sign-in is not accepted.
OpenID Connect: the openid and email scopes. An ID token whose email_verified is false is refused.

Options

Option	What it does
Require single sign-on	Password sign-in, emailed sign-in links, password resets and invitation links stop working for your people.
Break-glass owner	One owner who keeps password sign-in while single sign-on is required, in case your identity provider is down.
Just-in-time provisioning	Somebody on a verified domain who has no portal account yet gets one, as a member, the first time they sign in. Off, people need an invitation first.

Overview

The Overview shows your entitlement: the modules and seats you bought, the term and the days left, how many deployments you have registered out of the number allowed, the machine collector limit (or No limit), and whether registry access is included.

A pilot’s entitlement is a trial: the Overview says Trial — ends <date>, and every licence generated from it is a trial licence, with a 7-day grace period instead of 30.

Download Shield360

Open Downloads. Each release lists two images:

All-in-one: Shield360, PostgreSQL and ClickHouse in one container (<version>-allinone).
Platform with separate databases: the platform only, with a compose bundle at /app/selfhost (<version>).

Each release shows ready-to-copy docker pull commands, a docker run command for the all-in-one image, and the commands that copy the compose bundle out of the platform image.

To pull, you need a registry login:

Choose Get registry login.
Copy the command and run it on the host that pulls. Start the line with a space to keep it out of your shell history.
Pull the image within the time shown. A login lasts about an hour; get a new one before each pull.

Registry logins need an active entitlement that includes registry access. If the button is missing, the page says why.

For the full install steps, see Install Shield360 Enterprise from the image.

Register a deployment and generate its licence

Every licence from the portal is bound to one install, by its deployment ID.

In your install, open Settings → Licence → Register this deployment and copy the deployment ID. It starts with s360d_.
In the portal, open Deployments & licences, paste the ID, give the install a name, choose its environment, and choose Register.
Open the deployment’s Licences and choose Generate licence.
Copy the licence, or download it as a .lic file, and install it in Settings → Licence or set it in SHIELD360_LICENSE. See Self-hosted licence.

A generated licence:

carries the modules, seats and features of your entitlement,
carries your entitlement’s machine collector limit, if it has one: the most machine collectors an install may have active over 30 days. Past it, the install refuses new collector enrolments; collectors already enrolled keep reporting,
ends when your entitlement ends, with a 30-day grace period,
works only on the install whose deployment ID it was generated for.

You can register as many deployments as your entitlement allows. Archive one you no longer run to free its slot. Its licences keep working until they expire. Every licence you have generated stays listed under its deployment, and you can download it again.

Get support

Open Support and choose New ticket. Choose a category (installing, licensing, billing, bug, question or other) and a priority, and optionally the deployment it is about.

Shield360 support replies in the ticket. You are emailed when they reply or when the ticket’s status changes.
Reply in the ticket to add information. Replying reopens a resolved ticket.
Close a ticket when you are done, or reopen it later.

Everyone at your company with portal access sees your company’s tickets. Do not include passwords, API keys or licences in a ticket.

Next steps

Install from the image

Run the all-in-one container or the platform with separate databases.

Self-hosted licence

Install, renew and check the licence.