How We Protect Your Data
Your Data Stays Yours
- Every organization's data is walled off from every other organization by the database itself. Team members can reach only their own organization's events and attendees.
- You can export your attendee list any time, and you can ask us to permanently delete your organization and everything in it.
- Attendee profile photos are small, cropped images that are removed when the person or speaker they belong to is deleted.
Events Are Private by Default
- A new event is private. Only people you invite can register, and the event never appears in search engines.
- Only events you set to Public can be indexed by Google or listed in our sitemap. Everything else tells search engines to stay away.
You Decide Who Sees What on Your Team
- Owners and admins have full access. Volunteers can be given check-in only access, which lets them scan and search for attendees on event day and nothing else.
- API keys are shown to you once and stored only as a scrambled fingerprint, so even we cannot read them back. You can revoke a key at any time.
Shoal Staff Work in Your Account Only With Permission
- A small Shoal staff team can see account and event details to run the service and answer support requests, and every change they make through our staff tools is recorded.
- Staff can only work inside your dashboard when you turn on support access, for 24 hours, 3 days or 7 days. It switches itself off afterward.
- Every change a staff member makes while they are in your account is logged, and you can read that log from the Help section of your dashboard.
Payments Go Through Stripe
- Paid tickets are handled by Stripe. Card numbers go directly to Stripe and never touch Shoal's servers.
- Money goes to your own Stripe account. Shoal takes no cut of your ticket sales.
Sign-In and Passwords
- Organizers can sign in with a password, an emailed link, or Google or Microsoft where available.
- Sign-in is handled by Supabase Auth, so Shoal never stores your password in plain text.
Where Your Data Lives
- All traffic between your browser and Shoal travels over HTTPS.
- Event data and uploaded files are stored with Supabase in the United States, which encrypts stored data. The website runs on Vercel.
- A full list of the companies that handle data for us, and what they handle, is on our Subprocessors page.
Read the full details in our Privacy Policy and Subprocessors list.
Questions
Is Shoal certified or audited?
Not yet, and we won't claim it before it's true. What we can tell you is exactly how the product works, and everything on this page describes how it works today.
What happens if I want to leave?
Export your attendees whenever you like. If you want your organization deleted, write to us and we will remove it and everything in it.
Who do I contact with a security question?
Write to support@shoalevents.com. A real person reads it.
Plan Your Next Event on Shoal
Your first 2 events of up to 50 people are free if you create them before January 1, 2027. Set up in an afternoon.