Protecting the data our customers entrust to us is a core part of how Shape is built and operated. This page describes, at a high level, how Shape approaches encryption across our platform. We intentionally keep some implementation details — such as specific algorithms, key lengths, and key management infrastructure — out of this public document; that information is available to customers and prospects under NDA upon request.
Encryption in Transit
All data transmitted between your browser or application and Shape’s servers is encrypted in transit using industry-standard transport encryption (TLS). This applies to our web application, API, and any integrations that send or receive data through Shape.
- Connections to Shape are encrypted in transit; unencrypted connections are not permitted.
- We follow current industry best practices for supported protocol versions and cipher suites, and retire outdated or deprecated versions as they fall out of accepted use.
- Certificates are issued and managed through established, trusted certificate authorities.
Encryption at Rest
Backups of customer data and stored media are encrypted at rest using industry-standard encryption. Even with physical access to the storage itself, the data is unreadable without the keys. Production databases run on dedicated infrastructure in physically secured, SOC 2-audited data centers, are never directly reachable from the public internet, and are accessible only to a limited set of authorized systems and personnel.
- Offsite backups and stored media are encrypted at rest with industry-standard algorithms.
- Production systems run on dedicated hardware in access-c centers.
- Access to production data requires unique credentials and is limited to authorized systems and personnel.
Key Management
Encryption keys are stored separately from the data they protect, with access limited to authorized personnel. We do not publish the specifics of our key management architecture, as doing so would provide limited benefit to customers while giving unnecessary detail to anyone attempting to target our systems.
Requesting Additional Detail
Customers and prospects with specific security or compliance requirements — including procurement and security review teams — can request additional detail about our encryption practices, subject to a mutual non-disclosure agreement. Please contact your account representative or email help@setshape.com to request access.