Shoal
Security

How we think about security

Shoal is an early-stage company, so we'd rather tell you exactly where we are than overclaim. Here's our current approach and what's on the roadmap.

Encryption

Data is encrypted in transit with TLS. Sensitive data at rest — credentials, API keys, billing identifiers — is encrypted using industry-standard algorithms (AES-256).

Access control

Production access follows least-privilege: engineers get only the access their work requires, and administrative actions are logged.

Enterprise networking

Enterprise plans can request private networking (VPC peering or dedicated IP ranges) for workloads that need network-level isolation from shared infrastructure.

Data governance

We collect the minimum data needed to run the Service, retain it only as long as described in our Privacy Policy, and delete account data on request.

Compliance roadmap

We design our data-handling practices around the SOC 2 Trust Service Criteria — security, availability, and confidentiality — as we scale. Shoal is not yet SOC 2 certified. Formal SOC 2 Type II certification is on our roadmap, and Enterprise customers can request our current security posture and timeline directly.

Data processing agreements

Enterprise customers who need a signed Data Processing Agreement (DPA) for GDPR or similar requirements can request one — contact sales@shoal.online.

Reporting a vulnerability

If you believe you've found a security issue in Shoal, please email security@shoal.online with details. We'll acknowledge reports and aim to keep you updated as we investigate — please don't test against other customers' data or disrupt the Service while reporting.

Need a security questionnaire answered?

Email security@shoal.online and we'll get you what you need for procurement or vendor review.

Typical response time: within one business day