Security
Security you can check yourself
Independent labs grade shaka.rw in public. Open any report to run the check again today.
Lab results
Mozilla HTTP Observatory
A+
Hardened website
Strict browser safety rules on every page. The link runs the test again, live.
Qualys SSL Labs
A+
Encrypted connection
A+ on every Cloudflare edge address
Checked
Security Headers
A+
Locked session
HSTS, CSP, Permissions-Policy and Referrer-Policy in place
Checked
MxToolbox
p=reject
Authenticated mail
DMARC on shaka.rw is set to reject: forged mail from our domain is dropped.
Checked
Dated where the lab’s saved report shows a date (Mozilla’s doesn’t). The grades are the labs’ own — each link runs the check again, live.
Shaka Labs is not independently SOC 2 or ISO 27001 certified. Shaka runs on Cloudflare and Resend, which publish independent SOC 2 Type II reports (Cloudflare is also ISO 27001 certified). Each vendor shares its full reports through its own trust portal.
Also checked with Webbkoll(opens in a new tab) Internet.nl(opens in a new tab) ImmuniWeb(opens in a new tab) Hardenize(opens in a new tab) Google Safe Browsing(opens in a new tab) Cloudflare Radar(opens in a new tab)
Platform certificates
These attestations belong to Cloudflare and Resend, not to Shaka Labs. Full SOC 2 reports are confidential: each vendor shares them through its own trust portal.
Cloudflare, Inc.
SOC 2 Type II
Independent attestation of Cloudflare’s controls for security, confidentiality and availability.
Cloudflare runs Shaka’s app hosting, inbox database, file storage, inbound mail, chat, DNS and AI. Cloudflare’s report lists the exact products in scope.
Request the full report through Cloudflare’s trust portal.
Cloudflare, Inc.
ISO/IEC 27001:2022
Certified information security management system. Cloudflare also publishes ISO 27018 and ISO 27701.
Covers the platform controls of the Cloudflare products Shaka runs on.
Request the full report through Cloudflare’s trust portal.
Resend, Inc.
SOC 2 Type II
Independent attestation (Vanta and Advantage Partners) and a yearly third-party penetration test.
Covers the outbound mail Shaka sends on your domain.
Request the full report through Resend’s trust portal.
How Shaka protects your mail
- HTTPS for the app and the APIs.
- Hashed passwords, signed session cookies, organisation isolation by domain, admin-only mailbox creation and API keys.
- Mail is stored per organisation and mailbox; chat stays within the same email domain.
- Least-privilege operational access for Shaka Labs staff, only to run, secure and support the service.
- Shaka Labs platform staff and your organisation’s administrator can open your organisation’s mailboxes for support or administration. Every such access is logged.
- Shaka is not end-to-end encrypted. Don’t treat mail or chat as end-to-end encrypted.