Skyfense
Trust / Security

Security at Skyfense

Last reviewed: September 26, 2026

Skyfense sits in the request path of live storefronts, so protecting the data we handle is core to the product. This page describes the technical and organizational measures in place today, and is honest about the areas we are still strengthening.

1. Measures in place today

Encryption in transitAll traffic to Skyfense — probe, dashboard, and API — is served over HTTPS/TLS, with HTTP redirected to HTTPS and certificates managed automatically.
Password protectionAccount passwords are stored only as salted PBKDF2-HMAC-SHA256 hashes (310,000 iterations). We never store plaintext passwords, and a minimum password length is enforced.
Authenticated sessionsDashboard sessions are held server-side and referenced by a session cookie with a bounded lifetime. Password-reset requests are rate-limited per account and per IP.
Webhook verificationEvery Shopify webhook — including the mandatory privacy webhooks — is verified with an HMAC signature check before it is processed; unsigned or invalid requests are rejected.
Probe integrityProbe and challenge exchanges are signed and validated to resist replay and tampering.

2. Workspace and merchant isolation

Every record is scoped to a merchant workspace (tenant), and dashboard and API access is constrained to the authenticated user's own workspace. Isolation is enforced consistently across visit data, orders, devices, and forensics.

3. Access controls

Production database access is restricted at the network layer by an allowlist firewall, and administrative access to servers is limited to authorized operators. Deployment secrets are held in an encrypted secrets vault rather than in plaintext configuration. Within a merchant workspace, Skyfense does not currently offer differentiated user roles; all invited users of a workspace share the same access. Role-based access control is on our roadmap.

4. Logging and monitoring

Administrative changes within a workspace are recorded in an audit log (the acting user, a summary, and the request IP), and services emit operational logs. Audit records are designed not to contain passwords or payment data. We are formalizing centralized security monitoring and alerting.

5. Data retention and deletion

Visit records, session events, devices, fingerprints, and order records are deleted automatically once past the merchant's configured retention period (30, 90, 180, 365, or 730 days; default 365). Store uninstalls and shop-redaction requests trigger deletion of that merchant's data, including account users and the stored Shopify access token. See our privacy policy for detail.

6. Vulnerability management and incident response

We keep dependencies current and address security-relevant updates as part of ongoing maintenance. We are formalizing our vulnerability-management and incident-response processes, including documented severity handling and merchant notification timelines. If an incident affects merchant data, we will notify affected merchants without undue delay.

7. Areas we are strengthening

We believe published security claims should be accurate, so we are explicit about what is not yet in place. The following are in progress and not yet implemented as described elsewhere: encryption of data at rest at the storage layer, encrypted off-site backups with tested restore procedures, role-based access control within workspaces, and formal third-party audits. We do not currently hold certifications such as SOC 2 or ISO 27001, and we make no such claim.

8. Reporting a vulnerability

If you believe you have found a security vulnerability in Skyfense, please report it to hello@skyfense.com. We support responsible disclosure and will work with you to investigate and resolve valid reports.