How your data is kept separate.
Skylor holds your pipeline, your invoices and your team's records. This page says plainly how that data is separated, who can reach it, and what we have not done yet.
Your workspace is isolated at the query layer
Every tenant-owned model is read through a manager that filters by the current workspace before the query reaches the database. It is not a filter the page adds and could forget.
It fails closed: if a request carries no workspace, the queryset returns nothing rather than everything. The dangerous default is the safe one.
Roles and departments are enforced on the server
Who may see a record is decided by role and department, re-checked inside the view on every request. A member sees their own work, a manager sees their department's.
The interface reflects those permissions by hiding what you cannot do, but hiding a button is never what stops the action. Removing it from the page and calling the endpoint directly both hit the same check.
Synq sees exactly what you see, and no more
The AI layer reads through the same permission scoping as the screen you are looking at. Asking Synq is not a way around a permission you do not have.
Your conversations with Synq are private even from your workspace administrator. Usage totals and billing are visible to admins; the content of what you asked is not.
Encrypted in transit, hardened in the browser
Traffic is served over HTTPS with HSTS. Session and CSRF cookies are marked secure, and the session cookie is HttpOnly, so page scripts cannot read it.
Framing is denied outright, content-type sniffing is off, the referrer policy is strict-origin-when-cross-origin, and every state-changing request carries a CSRF token.
We never see your password
Passwords are stored as salted hashes using Django's authentication stack, and checked against strength, similarity and common-password validators when set.
Nobody at HubbleMind Labs can read your password, and support will never ask you for it. You can also sign in with Google and not set one at all.
Card details never touch Skylor
Payments run through Razorpay. Card numbers are entered on their checkout, not ours, and are never sent to or stored on our servers.
What we keep is the order and subscription identifier Razorpay returns, so we can tell which workspace a payment belongs to.
Your data stays yours
Your records export to CSV whenever you want them, without asking us and without a retention negotiation.
Deleted records go to a recycle bin first, so an accidental delete is recoverable rather than final.
Backed up nightly, and off-site
The database is backed up every night, and a copy is written to separate off-site storage so a single failure cannot take both.
A backup is also taken automatically before any release that changes the database, so a bad deploy has a way back.
What we do not claim
Security pages usually only list wins. These are the things a careful buyer will ask about, answered before you have to ask.
- We are not SOC 2 or ISO 27001 certified. Neither audit has been started.
- We have not commissioned a third-party penetration test.
- We do not publish an uptime SLA. Paid plans get support by email; there is no contractual availability guarantee yet.
- Two-factor authentication is not available yet. Google Sign-In is, and it carries whatever protection you have on your Google account.
We would rather write this down than let a certification logo imply something we have not earned. If any of it blocks your team, say so on a demo call. Knowing what stands in the way is how we decide what to build next.
Reporting a vulnerability
If you believe you have found a security issue, email hello@skylor.tech with enough detail to reproduce it. We will confirm we have received it and keep you updated while we work on a fix.
Please do not test against another workspace's data or run load or denial-of-service tests against production. If you need an account to test with, ask and we will set one up.
Our privacy policy covers what we collect and why; terms of service covers the commercial side.
Questions a page cannot answer
If your team has a security requirement we have not covered here, ask us directly. Knowing what blocks you is genuinely useful.