Trust Centre
Security, privacy and data protection, stated plainly.
Written for IT security, procurement and data-protection teams. Each topic says what is in place today, what our hosting providers deliver, and what is not yet available — so you can assess SkySign without a questionnaire round-trip.
Security contact
security@useskysign.comSecurity questionnaires, DPA questions and vulnerability reports.
Certifications: SkySign does not currently hold ISO 27001, SOC 2 or Cyber Essentials certification.
At a glance
Where each topic stands today
In place means SkySign does it today. Provider-managed means our hosting providers deliver it. Anything partial, draft or not yet defined is labelled that way.
Privacy and data protection
Data protection
In placeSkySign processes your staff’s personal data on your behalf, as a processor. The Privacy Policy sets out what is collected, why and for how long. DetailsUK GDPR
Draft termsProcessing is set up around UK GDPR: a processor role, a Data Processing Agreement and a published subprocessor list. Some legal details are still marked to be confirmed. DetailsGDPR (EU)
Draft termsThe same processor commitments apply to EU personal data. International transfer mechanisms are set out in the draft DPA and are still to be confirmed. DetailsData retention
In placeRecords are kept while your account is active. Deactivating a document or a person keeps their history. Deleting a document or a person also deletes their records. DetailsSubprocessors
PublishedSupabase, Vercel, Resend, Stripe, Anthropic (optional AI features only) and Google. What each provider processes, and why, is listed in full. DetailsData Processing Agreement
Draft for reviewA DPA is published for your legal team to review. Notice periods and some commercial terms are still marked to be confirmed. Details
Infrastructure
Data hosting
To be confirmedThe application runs on Vercel. The database, authentication and file storage run on Supabase, on Amazon Web Services. Primary region: [region — to be confirmed]. DetailsEncryption
Provider-managedTLS for every connection. The database and file storage are encrypted at rest (AES-256) by the hosting providers. Files are private and opened through links that expire after an hour. DetailsBackups
Provider-managedThe database is backed up automatically by Supabase. Backup frequency and point-in-time recovery depend on the plan in force; ask us for the current arrangement. DetailsDisaster recovery
Not yet definedSkySign does not yet publish recovery time or recovery point objectives. Provider-level recovery applies. DetailsBusiness continuity
Not yet definedA formal business-continuity plan has not been published yet. Ask us for the current arrangements during procurement.Service availability
No SLA todaySkySign does not offer an uptime commitment today. Vercel and Supabase publish their own service status pages. Details
Access and identity
Access controls
In placeRole-based permissions (Employer, Superuser, Employee) are enforced in the application and in database policies. Nobody can raise their own role. DetailsTenant isolation
In placeRow-level security scopes every query to one organisation. Within an organisation, any active member can open the organisation’s files through an expiring link. DetailsAuthentication
Partly availableStaff sign in with an email address and password (at least 12 characters) or with a Google account. Multi-factor authentication and single sign-on (Entra ID, SAML) are planned, not available. Details
Operations
Security monitoring
Provider-levelPlatform monitoring is provided by Vercel and Supabase. SkySign does not yet run a dedicated security-monitoring service of its own.Incident management
Draft timescalesSuspected incidents are investigated and affected customers told without undue delay. Contractual notification timescales are in the draft DPA. DetailsVulnerability reporting
OpenReport a vulnerability to security@useskysign.com. A security.txt file is published at /.well-known/security.txt. Email us
Records and evidence
Audit logging
Partly availableAcknowledgements, manual reminders, document deletions, password resets and onboarding are logged with who and when. Scheduled reminders, edits and user changes are not yet logged, and the log cannot yet be exported. DetailsAcknowledgement records
In placeEach record stores the exact acknowledgement statement accepted, the name the person typed, a server timestamp, the SHA-256 fingerprint of the document as issued, how they signed in, their IP address and browser, and any knowledge-check result. Records can’t be edited by anyone. Details
Documents
Everything your review needs, in one place.
Start with the security detail, then the subprocessor list and the draft DPA. If something you need is not covered, ask and we will answer in writing.
- Security detailHosting, encryption, isolation, sign-in, backups, logging, retention and AI processing in full.Open
- SubprocessorsEvery provider involved in running SkySign, what it processes and why.Open
- Data Processing AgreementThe draft DPA for your legal team, with open points clearly marked.Open
- Privacy PolicyWhat personal data SkySign handles, on what basis, and people’s rights over it.Open
- Sample audit reportThe exact fields an acknowledgement record carries, shown with sample data.Open
Questions
Questions procurement teams ask
Does SkySign hold ISO 27001, SOC 2 or Cyber Essentials?
No. SkySign does not currently hold ISO 27001, SOC 2 or Cyber Essentials certification. Our hosting providers, Vercel and Supabase, publish their own certifications and reports, which you can rely on for the infrastructure they run.
Where is our data hosted?
The application runs on Vercel, and the database, authentication and file storage run on Supabase on Amazon Web Services. The primary region is shown on this page; if you have a data-residency requirement, raise it before onboarding.
Can we sign a Data Processing Agreement?
Yes. A draft DPA is published for review. A few commercial and legal details are still marked to be confirmed, and we will work through them with your legal team.
Do you support single sign-on or multi-factor authentication?
Not yet. Staff sign in with an email address and password (at least 12 characters) or with a Google account. Single sign-on with Microsoft Entra ID or SAML, and multi-factor authentication, are on the roadmap and labelled as planned.
Is our content used to train AI models?
No. The optional AI features send only the document text an administrator chooses to summarise or edit, through Anthropic’s commercial API, which does not use that content for training. Staff names and acknowledgement records are never sent, and nothing is sent unless an administrator uses one of these features.
How do we report a security issue?
Email security@useskysign.com. We acknowledge reports and keep reporters informed. Our security.txt file is published at useskysign.com/.well-known/security.txt.
Bring your security questionnaire to the demo.
We will walk through hosting, isolation and records with your IT and data-protection team, and follow up in writing.
See how SkySign distributes, tracks and proves operational briefings in 20 minutes.