At palace level 7 enemies can pillage your resources not sustained by the vault.

Any enemy from your kingdom can attack your troops that aren't protected by peace treaties.

An enemy from another kingdom (possible during "global events") can attack your unshielded town at palace level 15 unless your town is associated with a clan tag. If the town belongs to a clan then it can be attacked by outsiders at any level and pillage rules are the same.

Edit: all actions are real-time... Logging out makes no difference and timers all continue.

a little trick if you join a clan and have not yet enough gold for buy a shield because you need usualy to wait 2 days for participate in clan event or 3 days for global event...

Most clan have 1 or more "bank"... they are people who are always shielded and mainly used for store rss from clan members... so, you can send your rss there for keep them safe... and you can do the same with your troop if you have not to much of them... send them as reinforcement to the bank and they will be protected...