Trust & data
Trust, data handling, and security posture
This page answers the questions a security team asks before adopting a tool: who processes your data, how it is stored and retained, and what we can and cannot claim today. It is written in the shape of a lightweight security questionnaire (CAIQ-lite) and kept deliberately honest. Where a control is planned rather than in place, we say so.
Who touches your data
Subprocessors
SkillPort relies on the following third parties to run the service. Each is used for a specific purpose with the minimum data required. Regions marked for operator confirmation are set at deployment.
| Provider | Purpose | Data involved | Location |
|---|---|---|---|
| Supabase | Managed Postgres database, authentication, object storage for skill packages, and edge functions. | Account records, profiles, API key prefixes and hashes, entitlements, download events, and the skill packages themselves. | Operator to confirm the selected region at deployment. |
| Vercel | Application hosting, serverless rendering, and content delivery for the web front end. | HTTP request metadata and edge logs. No customer database contents are stored at Vercel. | Global edge network. |
| GitHub | OAuth sign-in, and server-side import of source repositories for community and publisher skills. | OAuth identity (GitHub user id, handle, email) at sign-in; public repository contents at import time. | United States. |
| OAuth sign-in, where enabled as an identity provider. | OAuth identity (email and profile basics) at sign-in only. | United States. | |
| Anthropic | The language-model layer of the skill scanning pipeline analyses submitted skill content for injection and abuse. | Skill package text (documentation and scripts) sent for a single analysis call per version. No end-user personal data is sent. | United States. |
CAIQ-lite
Security questionnaire
Where is data stored, and how is it isolated?
All application data lives in a managed Supabase Postgres instance with row-level security enabled and forced on every table. Access is scoped per user and per organisation by database policy, not by application code alone.
How are API keys stored?
Keys are shown once at creation and never again. We store only a 16-character prefix and a SHA-256 hash of the full key. The plaintext key is never written to our database or logs. At the key's entropy (around 190 bits) a plain SHA-256 is the correct choice for the download hot path.
Is customer data encrypted?
In transit over TLS everywhere. At rest, encryption is provided by the managed Supabase and Vercel platforms. We do not operate our own storage layer.
Do you log personal data or IP addresses in the clear?
No. Download and install telemetry records a salted SHA-256 hash of the IP address using a daily-rotating salt, not the address itself. API key values are redacted from all logs. Product analytics events carry no key values and no personal identifiers.
How do you handle untrusted skill content?
Skill documentation is treated as hostile input. It renders only through a sanitising markdown pipeline with no raw HTML, hardened external links, and images blocked from publisher-controlled origins. The full vetting pipeline is described on the security page.
Can we get a Data Processing Agreement (DPA)?
Yes. A DPA is available on request. Contact the team to receive the current template.
Do you support single sign-on (SSO)?
Enterprise SAML SSO is available on request and requires the Supabase SSO add-on. It is configured per organisation with domain verification. Contact the team to enable it.
How can a user or organisation delete their data?
A signed-in user can request account deletion from account settings. The request revokes API keys and access immediately and removes bookmarks and reviews; final removal of the login record is completed within 30 days. See data subject rights below.
What we keep, and for how long
Data handling and retention
| Data | Retention |
|---|---|
| Account and profile | Kept while the account is active; removed on account deletion (login record within 30 days of request). |
| API keys | Prefix and hash kept until the key is revoked or the account is deleted; revoked keys stop working immediately. |
| Download and install events | Append-only, with hashed IP only. Retained to power install counts and abuse detection; no plaintext IP is ever stored. |
| Bookmarks and reviews | Kept while the account is active; deleted as part of an account deletion request. |
| Skill packages and scan records | Immutable and retained for catalogue integrity and reproducibility, so buyers can audit exactly which version was scanned. |
Honest status
Certifications and posture
We only claim controls we actually hold. The following entries state plainly where we are, including where the answer is “not yet”.
SOC 2 Type I
Planned, not yet startedWe do not hold a SOC 2 report and are not in an audit observation window. This is a planned engagement, not a current control. We will not claim certification until a report exists.
Penetration testing
Operator to completeAn independent penetration test is not yet scheduled. This entry will name the testing firm and date once one is booked.
Data Processing Agreement
Available on requestA DPA template is available to customers and prospects on request.
Vulnerability disclosure
Email intakeSecurity issues can be reported to the team by email; we action confirmed reports and can suspend an affected listing site-wide immediately.
GDPR and data subject rights
Your rights over your data
You can access the data on your account through the account area, and you can request erasure at any time. Requesting account deletion from account settings revokes your API keys and access immediately, deletes your bookmarks and reviews, and queues your login record for permanent removal, which is completed within 30 days by a separate administrative process. We are honest that the final login deletion is not instant: it is an authentication-admin step that cannot run inline, but your access ends the moment you confirm.
For any other data request, including a copy of your data or a correction, contact the team and we will action it.
How listings are vetted
The scan pipeline
Every version is validated and statically analysed. Community imports also require successful tool-free language-model analysis; publisher submissions are then approved by a human before they can be installed. A published version is bound to the exact bytes that were scanned, enforced at the database layer, so an approved-then-swapped package cannot reach the catalogue.