Security Built Around Clear Boundaries

Your company has its own workspace

When staff, drivers or portal customers sign in, the server checks which company and records they are allowed to use before returning any data.

The browser cannot grant itself access to another workspace. Private files also require a valid link to the right job, customer or driver.

• Company data separated on the server
• Separate staff, driver and portal sessions
• Extra checks for private documents
• Hidden menus are never treated as security

Access follows the person's role

Owners can configure the workspace, office teams can run jobs, finance staff can handle invoices and drivers receive a focused working view. The server checks permission for every protected action, even if a button is hidden on screen.

Workspace owners decide who to invite and should remove access promptly when someone leaves or changes role.

Sessions expire and sensitive links have limits

Staff sessions are securely signed, expire and are cancelled after important account changes. Passwords are stored using modern salted hashing rather than as readable text.

Verification, invitation and password-recovery links expire. Sign-in attempts are rate-limited to make automated abuse harder.

• Secure session cookies
• Signed, expiring sessions
• Rate-limited sign-in
• Session reset after password changes
• Time-limited recovery links

Documents are not public

Driver proof and compliance files are stored in private Cloudflare R2 buckets. New proof uploads are copied to a second private bucket, and every download requires an authorised session.

Private files are served with no-store caching and browser protections. Database snapshots and document manifests support recovery without exposing backups publicly.

Independent certification

Skiptastic does not currently hold ISO 27001, Cyber Essentials or another published independent security certification. We will only claim a certification when it has been achieved and can be evidenced.

If your business has specific security, retention, device or access requirements, raise them before subscribing so they can be assessed properly.

Related Skiptastic capabilities

Buyer questions

Can one skip company see another company's records?

Skiptastic's server resolves the authenticated organisation and applies tenant scope to workspace queries. Private document access also checks the narrower job, customer or driver relationship.

Are driver locations public?

No. Driver location is available only through authenticated, authorised operational workflows and is not exposed through public storefronts or marketing pages.

Is Skiptastic ISO 27001 certified?

Skiptastic does not currently claim ISO 27001, Cyber Essentials or another independent security certification.