Enterprise Security You Can Trust
From encryption to infrastructure, Ship Angel protects your data with always-on security and enterprise-level resilience.
Secure by Design
Every layer of Ship Angel is engineered with bank-level encryption, compliance, and 24/7 monitoring.
Bank-level encryption
All data encrypted in transit and at rest
99.9% Uptime
Reliable, always-available platform
24/7 Monitoring:
Continuous threat detection & response
How We Protect Your Data
Advanced Authentication
Multiple secure login options including SSO integration and OAuth with Google and Microsoft.
AWS-Powered Infrastructure
Built on Amazon’s enterprise-grade cloud infrastructure with defense-in-depth security.
Continuous Monitoring
Real-time threat detection and comprehensive logging across all systems.
Business Continuity
Comprehensive backup and disaster recovery plans ensure your data is always safe
Secure Development
Security built into every stage of our development lifecycle.
Data Privacy & Compliance
Strong data protection controls and privacy-by-design principles
Security FAQs
Yes, your data is protected by enterprise-grade security measures including encryption, access controls, and continuous monitoring. We use the same security standards as major financial institutions.
Only authorized users within your organization can access your data. Our role-based access control ensures users only see information relevant to their role. Ship Angel staff cannot access your business data without explicit permission.
Your data is stored in secure AWS data centers with redundancy across multiple availability zones. All data is encrypted at rest and in transit, with regular automated backups.
Yes, Ship Angel supports enterprise SSO integration with most identity providers. We also provide comprehensive APIs for security monitoring and audit log integration with your existing tools.
For any security-related inquiries, you can reach our dedicated team at security@shipangel.com. All reports and questions are handled promptly and confidentially.
Reporting a security issue
We welcome reports from anyone who finds a security problem in our products.
Please report in English. We will acknowledge your report within 5 business days.
Email us with:
A description of the issue and where you found it
The steps needed to reproduce it
What an attacker could actually do with it
Our commitment to you
If you report an issue in good faith and follow this policy, we will not pursue legal action against you. We will keep you updated as we investigate, and we're happy to confirm when a fix has shipped.
Rewards
We do not offer monetary rewards, bug bounties, or other compensation for security reports.
We're grateful for reports and we act on them, but we do not run a paid bounty programme and we will not enter into negotiations about payment. Please only send a report if you're comfortable with that.
What we ask of you
- Give us reasonable time to investigate and fix an issue before disclosing it publicly
- Only test against your own account or data — never access, modify, or download another customer's information
- Don't run automated scans that degrade service for our customers
- Don't attempt denial-of-service, social engineering, or physical attacks against our staff or infrastructure
Out of scope
Third-party services we use but do not operate. Please report those to the vendor directly.
Not treated as vulnerabilities
The following are common automated-scanner findings. We're aware of them and we don't treat them as security vulnerabilities without a working proof of concept that demonstrates real impact:
- Missing or misconfigured HTTP security headers, with no demonstrated exploit
- Clickjacking or UI-redress on pages that carry no state-changing action, including sign-in pages
- Raw output from automated scanners, submitted without a reproducible proof of concept
- Missing SPF, DKIM, or DMARC records on domains we don't send mail from
- Absence of rate limiting, with no demonstrated impact
- Self-XSS, or issues that require the victim to paste code into their own browser
- Software version disclosure, without a specific exploitable vulnerability
- Reports that require physical access to a device, or an already-compromised device or account
- Missing cookie flags on cookies that carry no session or sensitive data
Ready to Trust Us with Your Data?
Join hundreds of BCOs who trust Ship Angel with their sensitive shipping data.
Subscribe To Our Newsletter
Request A Customized Demo
See Ship Angel's AI-Native OS in action, and discover how it can streamline your shipping processes in one intelligent system.
