Security Built Around Clear Boundaries

Your company data is kept separate

When staff, drivers or portal customers sign in, the server checks which company and records they are allowed to use before returning any data.

The browser cannot grant itself access to another company's records. Private files also require a valid link to the right job, customer or driver.

• Company data separated on the server
• Separate staff, driver and portal sessions
• Extra checks for private documents
• Hidden menus are never treated as security

Access follows the person's role

Owners can change company settings, office teams can run jobs, finance staff can handle invoices and drivers receive a focused working view. The server checks permission for every protected action, even if a button is hidden on screen.

Company owners decide who to invite and should remove access promptly when someone leaves or changes role. A role or yard-access change is reviewed before confirmation, then signs out existing sessions so old access cannot continue. Staff limited to one yard see only that yard's work, vehicles, skips, safety records, invoices, waste records and totals; shared company settings remain available.

Sessions expire and sensitive links have limits

Staff sessions are securely signed, expire and are cancelled after important account changes. Passwords are stored using modern salted hashing rather than as readable text.

Verification, invitation and password-recovery links expire. Sign-in attempts are rate-limited to make automated abuse harder.

• Secure session cookies
• Signed, expiring sessions
• Rate-limited sign-in
• Session reset after password changes
• Time-limited recovery links

Documents are not public

Driver proof and compliance files are stored in private Cloudflare R2 buckets. New proof uploads are copied to a second private bucket, and every download requires an authorised session.

Private files are served with no-store caching and browser protections. Database snapshots and document manifests support recovery without exposing backups publicly.

Independent certification

Skiptastic does not currently hold ISO 27001, Cyber Essentials or another published independent security certification. We will only claim a certification when it has been achieved and can be evidenced.

If your business has specific security, retention, device or access requirements, raise them before subscribing so they can be assessed properly.

Related Skiptastic capabilities

Buyer questions

Can one skip company see another company's records?

No. After sign-in, Skiptastic checks which company the person belongs to before returning any records. Opening a private document also requires access to the matching job, customer or driver.

Are driver locations public?

No. Driver location is available only through authenticated, authorised operational workflows and is not exposed through public storefronts or marketing pages.

Is Skiptastic ISO 27001 certified?

Skiptastic does not currently claim ISO 27001, Cyber Essentials or another independent security certification.