# Shovels.ai

Electrification market intelligence platform

Research: https://www.safecli.org/company/shovels.ai
Company: https://shovels.ai

## Evidence status

Insufficient enterprise evidence
Source review: 2026-10-21T14:02:43.422Z
API: Public API

Company-published claims, not independently verified controls. Unknown is not evidence of absence.

## Procurement checks

### Security assurance — Mixed claims — review

> ### SOC 2 Type 2 Report

Source: https://trust.shovels.ai/
Reviewed: 2026-10-21T14:02:43.422Z

> ### SOC 2 Type 2 Representation Letter

Source: https://trust.shovels.ai/
Reviewed: 2026-10-21T14:02:43.422Z

> Is Shovels SOC 2 compliant?

Source: https://trust.shovels.ai/
Reviewed: 2026-10-21T14:02:43.422Z

> What does SOC 2 Type 2 mean, and why does it matter?

Source: https://trust.shovels.ai/
Reviewed: 2026-10-21T14:02:43.422Z

- [ ] Request the current audit report, scope, exceptions and expiry; confirm the vendor entity.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### SSO & provisioning — Not found


- [ ] Test SSO enforcement, user removal and privileged-account recovery.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Access controls — Not found


- [ ] Test least-privilege roles and cross-tenant access with separate test accounts.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Auditability — Not found


- [ ] Verify administrative and data-access events, retention and export.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Data handling — Company-published

> - Data Retention and Disposal Policy

Source: https://trust.shovels.ai/
Reviewed: 2026-10-21T14:02:43.422Z

> Data Retention and Disposal Policy

Source: https://trust.shovels.ai/
Reviewed: 2026-10-21T14:02:43.422Z

- [ ] Review DPA, subprocessors, retention, deletion, residency and AI training use.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Reliability & support — Company-published

> This includes controls related to logical access, change management, risk assessment, monitoring, incident response, and vendor management.

Source: https://trust.shovels.ai/
Reviewed: 2026-10-21T14:02:43.422Z

> Shovels maintains a formal Security Incident Response Plan covering identification, prioritization, containment, communication, and resolution.

Source: https://trust.shovels.ai/
Reviewed: 2026-10-21T14:02:43.422Z

- [ ] Request SLA, incident history, recovery targets and support escalation terms.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Product effectiveness — Needs clarification

> You may revoke this permission at any time by emailing legal@shovels.ai, and Shovels will cease new uses and remove the marks from then-current website and digital marketing materials within thirty (30) days, but need not recall or modify materials already printed, distributed, or in circulation.

Source: https://www.shovels.ai/terms
Reviewed: 2026-10-21T14:02:43.422Z

- [ ] Run a representative pilot against your current workflow; measure errors, missed cases, time saved and human review cost.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

## Decision

- Owner:
- Intended use and data sensitivity:
- Blocking requirements:
- Pilot success criteria:
- Unresolved risks:
- Decision and review date: