Security at SKØØLSKILL

Security is a first-class concern at SKØØLSKILL, not an afterthought. Most of our users are students who entrust us with their notes, study habits, and a growing record of what they find hard. We treat that responsibility seriously and design the Service so that the safe default is the easy default.

We follow the principles of least privilege, defence in depth, and data minimisation: we collect only what the Service needs, we limit who and what can reach it, and we assume any single control can fail and layer others behind it.

SKØØLSKILL runs on hardened Linux servers hosted within the European Union. Production systems are isolated from development and staging environments, and administrative access is restricted to a network perimeter protected by an authenticating proxy.

• Production databases are not exposed to the public internet.
• Background workers (note scanning, AI processing, email) run in separate tiers so a spike in one cannot starve the others.
• Secrets and credentials are stored outside source control and injected at runtime.

All traffic between your device and SKØØLSKILL is encrypted with TLS 1.2+. We enforce HTTPS everywhere and set a strict Content-Security-Policy to limit what can run in your browser.

Data is encrypted at rest, including your account record, the notes you scan, and file attachments stored in our object store. Passwords are never stored in plain text — they are hashed with a modern, salted algorithm.

Access to production data is limited to a small number of authorised personnel and granted strictly on a need-to-know basis. We use role-based access controls inside the application, and database-level row-level security so that one account can never read another account's data.

• Administrative actions are logged and auditable.
• Staff access uses strong authentication and is revoked promptly when no longer needed.
• We separate the data of each learning account at the database layer.

We build on a modern, actively maintained stack and keep dependencies patched. Our development practices include code review, automated checks, and protections against common web vulnerabilities such as cross-site scripting (XSS), cross-site request forgery (CSRF), and injection.

Authentication and session management are handled by a vetted framework rather than home-grown code, and sensitive operations require re-verification.

SKØØLSKILL uses AI to read your notes, generate practice, and power our tutor, Nova. This processing happens to deliver the Service to you — and only that.

• We do not use your content to train AI models, ours or anyone else's.
• Our AI providers are bound by contract not to retain or train on data sent through their APIs.
• You can delete your notes and content at any time, and we delete the associated data.

We take regular, encrypted backups so we can recover from hardware failure or accidental loss. Backups are retained for a limited period and are subject to the same access controls as production data. We periodically test our ability to restore from them.

We monitor our systems continuously for errors, anomalies, and abuse. Application errors and security-relevant events are captured and reviewed.

If we become aware of a security incident affecting your personal data, we will investigate, contain it, and notify affected users and the relevant authorities where required by law, in line with our Privacy Policy.

Payments are processed by Stripe, a PCI-DSS Level 1 certified provider. We never see or store your full card number — card data is sent directly to Stripe and tokenised. SKØØLSKILL only retains a reference and the minimum billing metadata needed to manage your subscription.

We are grateful to security researchers who help keep SKØØLSKILL safe. If you believe you have found a vulnerability, please email [email protected] with enough detail for us to reproduce it.

Acting in good faith under this policy, we will not pursue legal action against you for your research.

4cs BV is established in Belgium and processes personal data in accordance with the EU General Data Protection Regulation (GDPR). For details of what we collect, why, and your rights, see our Privacy Policy. We choose sub-processors that offer strong security and data-protection guarantees.

For security questions or to report a vulnerability: