Skip to main content
SECURITY & COMPLIANCE

Security is a discipline, not a marketing slogan. This page lists what we have in place today, what we’re still building, and the honest gaps we think you should know about before you trust us with your data. Enterprise customers can request our security questionnaire, architecture diagrams, and current sub-processor attestations at security@skode.ai.

TLS 1.2+
In transit
AWS S3
Managed encryption at rest
GDPR + DPDPA
Processor terms available
SOC 2
Readiness in progress
0h
Breach notification window
0-bit
API key entropy
0d
Automatic key rotation
0yr
Statutory invoice retention
Built on recognised standards
TLS 1.2+PBKDF2-SHA256GDPR / UK GDPRCCPA / CPRAIndia DPDPA 2023SAML 2.0OIDCOAuth 2.1 + PKCEFernet encryptionmTLSRFC 9116PCI SAQ-ATLS 1.2+PBKDF2-SHA256GDPR / UK GDPRCCPA / CPRAIndia DPDPA 2023SAML 2.0OIDCOAuth 2.1 + PKCEFernet encryptionmTLSRFC 9116PCI SAQ-A
Our approach

We’d rather under-promise than over-promise on the security of your data.

Everything below is what we genuinely have in place today — alongside an honest list of the gaps we’re actively working on.

Isolation by design

Role-based access control per workspace, org_id-scoped queries, and database-layer isolation — the same controls you see across the product.

  • Role-based access control per workspace
  • org_id-scoped queries with fail-closed filters
  • HTTP-only, Secure, SameSite=Lax session cookies
  • Workspace isolation enforced at the database layer
tenant isolation
Public edge
Auth + RBAC
Workspace vault
Cross-workspace request — bounced, fail-closed
What we have today

Infrastructure, application, data, and AI safeguards — what's actually running in production right now.

Infrastructure Security

  • Hosted on Amazon Web Services in the Mumbai region (ap-south-1). AWS operates this infrastructure within a SOC 2 Type II-attested environment. EU-based hosting is on our roadmap and not available today.
  • TLS 1.2 or higher on all external endpoints; HSTS applied on production hostnames
  • AWS-managed server-side encryption for files and backups stored in S3
  • Payment-gateway credentials stored inside our database with Fernet encryption
  • User passwords stored as PBKDF2-SHA256 hashes (Django default)
  • Private networking, security groups, and managed DDoS protection provided by AWS
  • Daily automated backups. End-to-end encryption of database backups is on the remediation roadmap — see Transparency section below.
  • Uptime targets described in our Service Level Agreement, published at /sla

Application Security

  • Email + password authentication (minimum 8 characters, PBKDF2-SHA256 hashing)
  • Optional social login with Google and Microsoft (OAuth 2.0)
  • Enterprise single sign-on: SAML 2.0 and OIDC (Okta, Azure AD / Microsoft Entra, Google Workspace, and other standards-compliant IdPs)
  • Role-based access control per workspace, with org_id-scoped queries and fail-closed filters
  • Session cookies are HTTP-only, Secure (in production), SameSite=Lax, with a 7-day maximum lifetime
  • CSRF protection, parameterised ORM queries, template auto-escaping, and input sanitisation on user- and AI-submitted content
  • Rate limiting on public API endpoints and login flows; brute-force protection on authentication
  • Two-factor authentication for end-user accounts is on our roadmap and not available today. We recommend a strong, unique password until it ships.

Data Security

  • Primary data residency: AWS Mumbai (ap-south-1). EU-based hosting is on our roadmap.
  • Daily automated backups retained per our disaster-recovery plan
  • Workspace isolation enforced at the database layer: every query is scoped to the requesting workspace with fail-closed behaviour
  • Audit logs for AI Connector actions retained for 30 days (failed events retained longer for investigation)
  • Lead-assignment logs automatically purged after 90 days
  • Export of workspace data on request by emailing privacy@skode.ai; self-serve export is on the roadmap
  • Deletion workflow on account closure: 30-day restore window, then data deleted within a further 90 days, subject to statutory retention of invoices (7 years under Indian Income-tax Act and CGST Act, Section 36)

AI Data Handling

  • External AI integrations (ChatGPT, Claude) are off by default and require workspace-admin activation
  • Personal fields (names, emails, phones, addresses, tax IDs) are pseudonymised before leaving Skode when returned to an AI provider — full algorithm documented in our AI Transparency Policy
  • Voice-to-text processed via OpenAI Whisper; transcripts are stored as CRM data, raw audio is not retained beyond the transcription call
  • Every AI Connector response carries X-OpenAI-Training: disallow and X-AI-Data-Classification: pseudonymized headers
  • No customer data is used to train Skode models or any third-party AI model
  • Honest limitation: free-text note bodies are not scanned for embedded personal data before being returned to the AI; we recommend treating notes as shareable with the connected AI
  • Full audit log of AI actions available via our GDPR Article 15 endpoint

Compliance

  • GDPR / UK GDPR — we operate as a processor under our Data Processing Agreement. Standard Contractual Clauses (EU) 2021/914 and the UK IDTA are used for onward transfers
  • CCPA / CPRA — see our California Privacy Notice
  • Indian Digital Personal Data Protection Act 2023 — Grievance Officer appointed; see /legal/grievance-officer
  • SOC 2 Type II — readiness assessment in progress. Skode Technologies Private Limited does not itself hold a SOC 2 attestation today; the AWS infrastructure we run on is SOC 2 Type II-attested by AWS.
  • ISO 27001 — not currently pursued
  • HIPAA — Skode does not sign Business Associate Agreements. Do not put Protected Health Information into Skode.
  • PCI DSS — card data is handled by Stripe and Razorpay; Skode falls within SAQ-A scope

AI Connector Security

  • Connectors disabled by default; require explicit workspace-admin activation
  • OAuth 2.1 with PKCE S256 and Dynamic Client Registration (or Client ID Metadata Documents) for ChatGPT and Claude integrations
  • API keys generated with 256-bit entropy, stored as SHA-256 hashes at rest, and automatically revoked after 90 days. Plain-text keys are shown once at creation only.
  • Mutual TLS (mTLS) validation on inbound requests from OpenAI Connectors (validates mtls.connectors.openai.com SAN)
  • Per-workspace and per-endpoint rate limits: 300 req/min sustained, 15/sec burst, 30 writes/min, 500 bulk lead operations per workspace per day
  • Every AI Connector request and response logged to an Integration Event audit trail (30-day retention for success; longer for failures)
  • Instant connector deactivation revokes all active keys immediately
  • Known gap: OAuth tokens for upstream integrations are a current remediation item; we are migrating them to application-layer encryption — see Transparency section below

Incident Response

  • Dedicated security incident response team
  • Customer notification within 72 hours of confirmed breach
  • Post-incident review with root cause analysis
  • Continuous monitoring and alerting
  • Status page at status.skode.ai for real-time updates
Full transparency

Over-promising on security is worse than under-promising. These are the items we know about and are actively working on.

If any of them blocks your deployment, talk to us at security@skode.ai — some can be addressed contractually today.

Two-factor authentication for end-user accounts is not yet shipped. On our roadmap.
Email verification is not currently enforced at signup. On our roadmap.
Skode Technologies Private Limited does not yet hold its own SOC 2 attestation. Readiness assessment is in progress; the AWS infrastructure we run on is SOC 2 Type II-attested by AWS today.
ISO 27001 is not currently pursued.
OAuth tokens for upstream integrations are being migrated to application-layer encryption; today they rely on database-layer access controls. Remediation is in active development.
Database backups are being moved to encrypted, off-site storage with key rotation. Today we run daily backups with AWS-managed encryption at the disk layer.
Anomaly detection and SIEM-grade security monitoring are not yet deployed. Today we rely on standard application logging, rate limiting, and audit trails.
Continuous SAST/DAST scanning in CI is on our roadmap. Today we run manual dependency review and standard Django framework protections.
EU data residency is not available today. Primary region is AWS Mumbai. Contact us if this is a commitment blocker.
No formal bug-bounty programme today. We welcome coordinated disclosure under our Responsible Disclosure policy below.
Work with us

Responsible Disclosure

If you discover a security issue, please report it to us first. We commit to a safe-harbour for good-faith research, acknowledgement of reports within two business days, and a no-legal-action policy for researchers who follow this process. Our machine-readable contact details are published at /.well-known/security.txt per RFC 9116. A formal bug-bounty programme is on our roadmap and not yet in place.

security@skode.ai

Request a Security Review

Enterprise customers can request detailed security documentation, penetration test reports, and complete a security questionnaire.

Contact Sales
TRUST, EARNED HONESTLY

Request our security questionnaire, architecture diagrams, and current sub-processor attestations — or report a vulnerability under our Responsible Disclosure policy.