Data Protection

Encryption in Transit

• All connections use TLS 1.2 or higher
• HTTPS enforced across all endpoints
• HSTS (HTTP Strict Transport Security) enabled
• Modern cipher suites only

Encryption at Rest

• Database encryption using AES-256
• Encrypted backups
• Secrets and API keys encrypted with additional application-level encryption

Password Security

• Passwords hashed using bcrypt with appropriate work factor
• No plaintext password storage
• Secure password reset via email tokens

Infrastructure

Hosting & Data Location

• Hosted on reputable cloud providers with SOC 2 and ISO 27001 certifications
• European data centres (UK/EU) where available
• Regular automated backups
• Disaster recovery procedures in place

Network Security

• Firewalls and network segmentation
• DDoS protection
• Regular security updates and patching
• Minimal attack surface - only necessary ports exposed

Access Control

Internal Access

• Principle of least privilege
• Multi-factor authentication (MFA) required for all team members
• Access logging and audit trails
• Regular access reviews

API Security

• API keys for authentication
• Rate limiting to prevent abuse
• Request validation and sanitization
• Secure token generation using cryptographic random sources

Development Practices

• Security-focused code reviews
• Dependency vulnerability scanning
• Separation of development, staging, and production environments
• No production data in development environments
• Secure CI/CD pipelines

Compliance

GDPR

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This includes:

• Lawful basis for data processing
• Data subject rights (access, deletion, portability)
• Data minimization
• Appropriate data retention periods
• Data processor agreements with third parties

Cyber Essentials

We follow the principles of the UK Cyber Essentials framework:

• Firewalls: Boundary firewalls and internet gateways configured
• Secure Configuration: Systems configured to reduce vulnerabilities
• Access Control: User accounts managed with appropriate privileges
• Malware Protection: Protection against viruses and malware
• Patch Management: Regular updates and security patches

Data Retention

• Webhook payloads: Retained for your plan's period (3-30 days), then permanently deleted
• Account data: Retained while active, deleted within 30 days of account closure
• Logs: Retained for 90 days for debugging and security purposes
• Backups: Retained for 30 days, then securely destroyed

Security Incident Response

In the event of a security incident:

• We will investigate and contain the incident immediately
• Affected users will be notified within 72 hours as required by GDPR
• We will work with appropriate authorities if required
• A post-incident review will be conducted to prevent recurrence

Responsible Disclosure

We welcome security researchers to help us keep Skooh secure. If you discover a vulnerability:

• Email us at [email protected]
• Provide sufficient detail to reproduce the issue
• Give us reasonable time to address the issue before disclosure
• Do not access or modify user data without permission

We appreciate your help and will acknowledge researchers who report valid vulnerabilities.

What We Don't Do

For transparency, here's what we currently don't offer (but may in the future):

• SOC 2 Type II certification (we're a startup - but we follow the principles)
• Dedicated infrastructure (multi-tenant architecture)
• Custom data residency requirements
• Enterprise SLAs with financial penalties

If you need these features, please contact us to discuss your requirements.

Contact

For security-related questions or to report a vulnerability:

Email: [email protected]

For privacy-related questions, see our Privacy Policy.