Security
Security at SKOOR
Our users trust SKOOR with their sensitive financial data and rely on us to be good custodians of their customers' data as well. As a financial operating system, our security posture continually evolves to meet the rigorous standards of the global financial industry.
Standards and compliance
SKOOR uses best-in-class security practices to maintain a high level of security across all systems.
SOC 2 readiness
SKOOR's systems, processes, and controls are designed against the AICPA Trust Services Criteria for Security, Availability, and Confidentiality, and our internal controls are mapped to those criteria and reviewed quarterly by our security team. SKOOR has not yet completed an independent SOC 2 Type II audit. We plan to engage an independent auditor as the business grows, and we will publish our attestation status on this page.
OFAC/BSA compliance
All transactions processed through SKOOR are screened against the OFAC Specially Designated Nationals (SDN) list. Screening is always enabled and cannot be disabled — this is enforced at the type system level. We maintain 7-year audit retention for compliance receipts as required by BSA regulations.
PCI DSS v4.0
SKOOR's card issuance and payment processing integrations comply with PCI DSS v4.0 requirements. Sensitive cardholder data is never stored on our systems — we rely on certified payment processors for card data handling.
Privacy and data protection
SKOOR complies with CCPA and GDPR data protection requirements. We implement data minimization, right-to-erasure with cryptographic verification, and maintain a formal data classification policy across four sensitivity tiers.
AI and your data
SKOOR's agents are powered by Anthropic's Claude models through the Claude API. Under Anthropic's commercial terms, data sent through the API is not used to train Anthropic's models. Chief of Staff (internal dogfood today; external workspaces gated on a DPA) uses Cursor cloud, operated by Anysphere, Inc. That account is run with Privacy Mode on so Anysphere's zero-data-retention agreements with model providers apply; SKOOR does not use those prompts to train SKOOR models, and customer secrets are stripped before send. Your financial data is used only to operate your account: we never sell it, and we never use it to train AI models — ours or anyone else's. See the Chief of Staff privacy notice and subprocessor exhibit.
Product security
Security is one of SKOOR's guiding principles for all product design and infrastructure decisions. We offer a range of features to help our users protect their financial data.
Authentication and access control
SKOOR supports multiple authentication methods including email, Google OAuth, and wallet-based login. Admin access requires multi-factor authentication with TOTP. All sessions use short-lived tokens that are stored in memory only — never in localStorage or cookies accessible to JavaScript.
Tenant isolation
Every API request is scoped to the authenticated tenant. A dedicated resolution layer enforces data isolation at every query boundary — no tenant can access another tenant's data regardless of API key or session state. This is enforced by middleware that runs before any business logic.
Rate limiting and abuse prevention
All API surfaces implement tiered rate limiting: 100 requests per second for standard APIs, 10 per second for management endpoints, and 5 attempts per minute for authentication. Transaction velocity limits are enforced per-tenant with configurable thresholds using sliding window algorithms.
API key security
API keys are hashed with SHA-256 before storage and compared using constant-time algorithms to prevent timing attacks. Keys support IP allowlisting and automatic rotation on a 90-day cycle. Compromised keys are rotated within 24 hours of detection.
Audit logging
Every sensitive action is recorded in an immutable, hash-chained audit log. This includes login events, API key changes, transaction processing, compliance screening decisions, and administrative actions. Audit logs are retained for 7 years to meet BSA requirements.
Encryption
HTTPS and HSTS for secure connections
We mandate the use of HTTPS for all services using TLS 1.2 or higher, including our public website, dashboard, and API. We enforce HSTS with a one-year max-age and includeSubDomains directive. Our systems automatically reject connections using older, less secure TLS versions.
Encryption at rest
All sensitive data is encrypted at rest using AES-256-GCM with scrypt-derived keys. Critical secrets (private keys, access tokens, encryption keys) are stored in a dedicated credential vault that is separate from application data. Column-level encryption protects personally identifiable information even if the underlying storage is compromised.
Data isolation
Sensitive financial credentials (bank tokens, payment processor keys) are stored in an isolated environment separate from application logic. No application code can access plaintext credentials directly — all operations go through a controlled, audited interface.
Infrastructure safeguards
Continuous monitoring
SKOOR runs automated security monitoring 24/7. Our internal monitoring agents detect anomalies, behavioral drift, and infrastructure degradation in real-time. Critical alerts trigger immediate notification to on-call engineers with a response SLA of under 1 hour for severity-1 incidents.
Circuit breakers and fault isolation
All critical payment paths implement circuit breakers that automatically halt processing when failure thresholds are exceeded. This prevents cascading failures and protects user funds during infrastructure incidents. Recovery is automated with exponential backoff.
Security headers
Every response from SKOOR includes security headers: Content-Security-Policy, X-Frame-Options (DENY), X-Content-Type-Options, Strict-Transport-Security, Referrer-Policy, and Permissions-Policy. Frame embedding is blocked to prevent clickjacking. Geolocation, microphone, and camera permissions are explicitly disabled.
Input validation and sanitization
All incoming requests are validated and sanitized at the boundary. We strip prototype pollution vectors, enforce query string length limits, normalize addresses, and validate request bodies against strict schemas. Error responses never leak internal state, stack traces, or system paths.
Log redaction
Our structured logging system automatically redacts 26 sensitive field paths before any data reaches log storage. This includes tokens, keys, passwords, card numbers, and personally identifiable information. Full detail is available to authorized engineers via controlled access only.
Incident response
Response time objectives
We maintain formal incident response procedures with defined severity levels and response commitments:
| Severity | Response Time | Recovery |
|---|---|---|
| Critical (data breach, settlement failure) | < 1 hour | Zero data loss |
| High (>50% degradation) | < 4 hours | < 1 hour data loss |
| Medium (partial outage) | < 24 hours | < 4 hours data loss |
| Low (minor issue) | < 72 hours | < 24 hours data loss |
Post-incident review
All critical and high-severity incidents require a post-mortem review within 48 hours. Reviews are blameless and focused on systemic improvements. Findings are tracked to resolution and verified in subsequent review cycles.
Vendor management
Third-party security requirements
All vendors that handle sensitive data (Tier 2 or above) must demonstrate SOC 2 Type II compliance or equivalent security certification. Data Processing Agreements are required for any vendor processing personally identifiable information. We conduct quarterly vendor security reviews and maintain a formal vendor risk register.
Data minimization
We share only the minimum data required for each vendor integration to function. Bank connection tokens, payment credentials, and user data are compartmentalized — no single vendor has access to a user's complete financial profile.
Secure development
Code review and testing
All code changes require review before deployment. Our CI/CD pipeline enforces linting, type checking, automated testing, and build verification on every change. Security-sensitive changes receive additional scrutiny from security-focused reviewers.
Dependency management
We continuously monitor dependencies for known vulnerabilities. High and critical severity CVEs block deployment and are addressed within 24 hours. We maintain a formal acceptable-use policy that prohibits installing non-approved packages.
Secret detection
Pre-commit hooks scan all code changes for accidentally committed secrets, API keys, and credentials. Our systems validate at startup that all required secrets are present and correctly formatted — missing or malformed secrets prevent the application from serving traffic.
Security contact
If you believe you've found a security vulnerability in SKOOR, please report it to us responsibly. We take all security reports seriously and will respond within 24 hours.
Email: security@skoor.ai
Response SLA: 24 hours for initial acknowledgment
Scope: skoor.ai, api.skoor.ai, and all SKOOR-published SDKs