Security at Skofa
Skofa runs real parts of real businesses, so the controls below are built into the product and covered by automated tests — not promises on a page.
Your business's data stays your business's
- Every record belongs to exactly one business, and every request is authorized against the signed-in person's own membership of that business on the server — never against an id the browser sends.
- Cross-business access is attacked on purpose in our automated test suite: one business's session, API key or guessed record ids are checked to never reach another business's data.
- API keys are confined to the business that created them and to the scopes chosen at creation.
Accounts and sign-in
- Two-factor authentication (authenticator app, with one-time recovery codes) for every account; mandatory for Skofa staff accounts with platform access.
- Sessions are random 256-bit tokens of which only a hash is stored, expire after 24 hours of inactivity, and end immediately when an account is suspended.
- Sign-in, sign-up and password-reset attempts are rate limited.
- Changing your password or two-factor settings sends you a security alert.
Credentials and secrets
- Passwords are hashed with bcrypt. API keys and invitation links are stored only as SHA-256 hashes.
- Credentials for the software you connect, and webhook signing secrets, are encrypted at rest with AES-256-GCM, with support for rotating the encryption key.
- Secrets are never sent to the browser after the moment they are created.
Your AI employees act under your rules
- You set each AI employee's autonomy level. Financial, destructive and outbound-message actions always wait for a person to approve them, whatever the autonomy level.
- Content from websites, emails, documents and connected systems is treated as data, never as instructions to an AI employee.
- Outbound requests to addresses you configure are checked so they can never reach private or internal networks.
Everything important is recorded
- Sign-ins, AI employee changes and runs, approvals, data changes, integration and permission changes, API key creation and revocation, and failures are written to an audit log with who, what, when and a request id.
- Signed webhooks (HMAC-SHA256 with a timestamp) let your own systems verify that an event really came from Skofa.
You stay in control of your data
- Owners and admins can export all of their business's data at any time.
- Deleting a business starts a 14-day grace period, after which its data and files are permanently removed and connected software access is revoked.
Certifications
Skofa does not currently hold a SOC 2 or ISO 27001 certification. We would rather tell you that plainly than imply otherwise. Our data processing terms are in the Data Processing Agreement, and the companies that help us run the service are listed on our subprocessors page.
Status and reporting
Live service health is on the status page. To report a security concern, open a support request from inside Skofa or contact us through your account; please do not include sensitive data in the first message.