Security Policy

• The platform runs on professional European and US cloud infrastructure from established providers (see the subprocessor list for details).
• Customer data is stored in data centres within the European Economic Area wherever possible.
• Systems receive security updates on a regular basis.

• All connections are encrypted with TLS (HTTPS).
• Data is encrypted at rest.
• Passwords are never stored in readable form, only as secure hashes.

• Access to production systems and customer data is limited to people who need it for their work (least privilege).
• Administrative access is protected with multi-factor authentication (MFA).
• Each customer workspace is logically isolated from other customers; your data is never visible to other customers.
• Staff and engaged persons are bound by confidentiality.

• Customer data is backed up automatically on a regular schedule.
• Backups are stored encrypted and periodically tested for recoverability.
• In case of a serious outage, we restore the service from the most recent usable backup.

• Security incidents are logged, investigated and resolved following a fixed process: detect, contain, recover, evaluate.
• If an incident affects personal data of your customers, we notify you without undue delay and at the latest within 48 hours of discovery (see the Data Processing Agreement).
• After every relevant incident we run an evaluation and improve our measures where needed.

• Data in your workspace is retained for as long as your account is active.
• After termination, you can export your data for 30 days; we then delete it from active systems and backups within 90 days.
• Security log files are kept for a maximum of 30 days.
• Statutory retention obligations (such as tax retention periods for invoices) may require longer retention.

Found a vulnerability in our systems? Please report it via our Responsible Disclosure Policy at skydust.io/legal/responsible-disclosure.

Questions about security, or does your organisation have a security questionnaire for us to complete? Email karlo.timmerman@skydust.io.