Security & Trust

Skytek Desk is a multi-tenant communications platform — voice, SMS, CRM, support desk, and billing — serving businesses that trust us with their customer data every day. Security is built into how we engineer the platform, not bolted on afterward. This page summarizes the safeguards we have in place.

Data Isolation

Skytek Desk is multi-tenant, and keeping one customer's data completely separate from another's is our highest priority. Every request for tenant data is scoped to the authenticated account, and this isolation is enforced automatically by checks in our build pipeline — code that could read across customer boundaries is blocked before it can ever ship. This is a structural guarantee, not a matter of a developer remembering to add a filter.

Encryption

All data is encrypted in transit using industry-standard TLS, and encrypted at rest on our cloud infrastructure. This includes your messages, contacts, call recordings, and financial information. Sensitive credentials, such as your online-banking logins, are never seen or stored by Skytek — they are handled directly by our specialized providers.

Authentication & Access Control

Access to the platform uses token-based authentication with secure, environment-isolated sessions and single sign-on through trusted identity providers (Google and SkySwitch). We enforce automatic account lockout after repeated failed login attempts and track login activity to detect unusual access. Internally, access to customer data is limited to personnel who need it to operate and support the service.

Secure Development & Scanning

Security is checked continuously, not just at audit time. On every change to our codebase we automatically run:

• Dependency vulnerability scanning — alerts us to any third-party library with a known security flaw.
• Secret scanning — catches any credential or API key that might be accidentally committed, including across our code history.
• Static application security testing (SAST) — analyzes our own code for security weaknesses such as injection or data-exposure risks.

In addition, a suite of automated code-quality and security rules — each one grounded in a real lesson learned — runs on every pull request and blocks unsafe patterns from reaching production.

Infrastructure

Skytek Desk runs on Amazon Web Services (AWS), one of the most secure and widely audited cloud platforms in the world. We benefit from AWS's physical security, network protection, and compliance certifications for the underlying infrastructure, including encryption of data at rest.

Payment Data

We never store raw payment-card numbers. Card data is tokenized through our payment processors, and our codebase has an automated safeguard that prevents card numbers from being written to our database. Bank-account connections for bookkeeping features are handled through a specialized, regulated provider — we receive only the limited financial data needed to provide those features, and never your banking credentials.

Compliance

We operate under a signed Business Associate Agreement (BAA) with AWS, supporting workloads that involve protected health information, with automated controls that block any AI or transcription vendor lacking the required coverage when HIPAA mode is enabled.

For payments, we follow PCI-aligned handling — card data is tokenized and never stored. We are not currently SOC 2 or ISO 27001 certified; however, we maintain an internal security control program aligned with the SOC 2 Trust Services Criteria, and we will pursue a formal SOC 2 examination for any customer whose engagement requires the signed report. Detailed security documentation is available to customers and prospects under NDA on request.