EN FR RW
Get started

Security

Security you can check yourself

Independent labs grade shaka.rw in public. Open any report to run the check again today.

Lab results

Dated where the lab’s saved report shows a date (Mozilla’s doesn’t). The grades are the labs’ own — each link runs the check again, live.

Shaka Labs Ltd is not independently SOC 2 or ISO 27001 certified. Shaka runs on Cloudflare and Resend, which publish independent SOC 2 Type II reports (Cloudflare is also ISO 27001 certified). We share their full reports with customers on request, under the vendors’ confidentiality terms.

Also checked with Webbkoll(opens in a new tab) Internet.nl(opens in a new tab) ImmuniWeb(opens in a new tab) Hardenize(opens in a new tab) Google Safe Browsing(opens in a new tab) Cloudflare Radar(opens in a new tab)

Platform certificates

These attestations belong to Cloudflare and Resend, not to Shaka Labs Ltd. Full SOC 2 reports are confidential; we share them with customers on request.

  • Cloudflare, Inc.

    SOC 2 Type II

    Independent attestation for security, confidentiality and availability. Every Cloudflare plan is in scope, including Workers, D1, R2, Email Routing, Durable Objects and Workers AI.

    Covers Shaka’s app hosting, inbox database, file storage, inbound mail routing, chat, DNS and the mail assistant.

    Full report under NDA — ask us.

    Cloudflare SOC 2 overview(opens in a new tab)

  • Cloudflare, Inc.

    ISO/IEC 27001:2022

    Certified information security management system. Cloudflare also publishes ISO 27018 and ISO 27701.

    Covers the platform controls of the Cloudflare products Shaka runs on.

    Full report under NDA — ask us.

    Cloudflare ISO overview(opens in a new tab)

  • Resend, Inc.

    SOC 2 Type II

    Independent attestation (Vanta and Advantage Partners) and a yearly third-party penetration test.

    Covers the outbound mail Shaka sends on your domain.

    We can share a copy from our vendor account on request.

    Resend security overview(opens in a new tab)
Request platform reports Data Processing Agreement

How Shaka protects your mail

  • HTTPS for the app and the APIs.
  • Hashed passwords, signed session cookies, organisation isolation by domain, admin-only mailbox creation and API keys.
  • Mail is stored per organisation and mailbox; chat stays within the same email domain.
  • Least-privilege operational access for Shaka Labs Ltd staff, only to run, secure and support the service.
  • Shaka is not end-to-end encrypted — don’t treat mail or chat as end-to-end encrypted.

Contracts Privacy DPA Terms