Your data is yours. We protect it.
Security is not an afterthought at Skillonize — it is built into the database layer, API design, authentication system, and infrastructure from the start. This page explains our security posture and privacy practices in plain language.
Security Architecture
Encryption in Transit & at Rest
All data transmitted between clients and AHCOS servers uses TLS 1.3. Data at rest in PostgreSQL is encrypted using AES-256.
Row-Level Security (Multi-Tenancy)
Every database query is scoped to the authenticated organisation via PostgreSQL Row Level Security (RLS). One organisation cannot access another's data — at the database layer, not just the application layer.
Authentication & Session Management
AHCOS uses JWT-based authentication via Supabase Auth. Sessions are short-lived with secure refresh token rotation. Passwords are hashed using bcrypt; we never store plaintext credentials.
Role-Based Access Control
Every action is controlled by roles (Owner, Admin, Member, Viewer) at the organisation level. Permissions are enforced server-side on every request — UI-only guards are never relied upon.
Infrastructure Security
Platform infrastructure runs on Supabase-managed PostgreSQL with automated backups, point-in-time recovery, and no direct public database access. API servers are isolated behind the platform proxy.
Input Validation & API Security
All API inputs are validated with Zod schemas generated from the OpenAPI specification. SQL injection is prevented by Drizzle ORM's parameterised queries. Rate limiting is applied on all public endpoints.
Privacy Practices
What data we collect
- —Account information (name, email, organisation)
- —Learning progress, course completions, and capability profile data
- —AI conversation history (used to personalise coaching)
- —Feature usage analytics (aggregated, not sold)
- —Feedback and support submissions
What we do NOT do
- —We do not sell your personal data to third parties
- —We do not use your data to train public AI models without consent
- —We do not share individual-level data with your organisation's admins without your knowledge
- —We do not use tracking cookies for advertising purposes
- —We do not store payment card data (handled by our payment processor)
Compliance & Certifications
GDPR-aligned
Data subject rights (access, erasure, portability) are supported.
SOC 2 Type II (Planned)
Audit in progress for 2026. Controls are being implemented now.
Data Processing Agreements
DPAs available for Enterprise customers on request.
Vulnerability Disclosure
Report security issues to security@skillonize.com — we respond within 48 hours.
AI & Your Data
The AHCOS Intelligence Engine uses your capability profile, learning history, and conversation context to personalise coaching and recommendations. This data is processed on our servers and is never shared with third parties or used to train public AI models.
AI conversations are retained to improve personalisation across sessions. You can request deletion of your AI conversation history at any time via Account Settings.
Aggregate, anonymised usage patterns may be used internally to improve the AI model. Individual-level data is never included in any shared dataset.
Questions or concerns?
If you have a security question, want to report a vulnerability, or need a Data Processing Agreement, contact our security team. We aim to respond within 48 hours.