Security and compliance

Skrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.

Skrum is not SOC2 certified. This page describes the controls we implement. No badges we did not earn.

What Skrum implements

• Envelope-encrypted secrets at rest (AES-256-GCM, keyed by MASTER_ENCRYPTION_KEY).
• Session-based authentication with optional TOTP two-factor.
• Role-based access control with a tamper-evident, append-only tenant audit trail.
• Rate limits on every mutation surface; pino redaction across every credential path.
• Cross-account isolation returns 404, not 403 — the existence of a foreign resource is never disclosed.
• Data Processing Addendum with click-acceptance and a downloadable receipt.
• GDPR data-rights endpoints (export + delete with a grace window).
• Sanctioned workspace ownership-transfer flow with step-up re-authentication.

Audit trail and residency

• Audit trail. Settings → Compliance → Audit. Read + CSV/JSON export (the export gate is a tier feature). CSV cells are neutralized against spreadsheet formula injection.
• Data residency. Skrum shows the configured deployment region.
• DPA. Accept the current version from Settings → Compliance. The receipt is downloadable.

See also: Skrum documentation