Protecting the data our customers entrust to us is a core part of how Shape is built and operated. This page describes, at a high level, how Shape approaches encryption across our platform. We intentionally keep some implementation details — such as specific algorithms, key lengths, and key management infrastructure — out of this public document; that information is available to customers and prospects under NDA upon request.
Encryption in Transit
All data transmitted between your browser or application and Shape’s servers is encrypted in transit using industry-standard transport encryption (TLS). This applies to our web application, API, and any integrations that send or receive data through Shape.
- Connections to Shape are encrypted in transit; unencrypted connections are not permitted.
- We follow current industry best practices for supported protocol versions and cipher suites, and retire outdated or deprecated versions as they fall out of accepted use.
- Certificates are issued and managed through established, trusted certificate authorities.
Encryption at Rest
Customer data stored within Shape’s platform is encrypted at rest. This protects data stored on disk, in backups, and in database systems, so that the underlying storage media alone is not sufficient to access customer data.
- Encryption at rest is applied using industry-standard encryption algorithms.
- Encryption keys are managed separately from the data they protect, and access to key management systems is restricted to a limited set of authorized systems and personnel.
- Backups of customer data are encrypted using the same standards as production data.
Key Management
Shape maintains internal key management practices designed to limit who and what can access encryption keys, rotate keys on an appropriate schedule, and revoke access when it is no longer needed. We do not publish the specifics of our key management architecture, as doing so would provide limited benefit to customers while giving unnecessary detail to anyone attempting to target our systems.
Requesting Additional Detail
Customers and prospects with specific security or compliance requirements — including procurement and security review teams — can request additional detail about our encryption practices, subject to a mutual non-disclosure agreement. Please contact your account representative or email help@setshape.com to request access.