Trust

Security

This page describes the technical and operational controls protecting data on the KSKILL Integra Training Centre platform. It reflects what is deployed today; where a control is planned but not yet in place, it says so.

Last updated: 15 August 2026

Encryption

In transit. All connections between browsers, clients, and the Service use TLS 1.3. HTTP is redirected to HTTPS. HSTS is enabled with a one-year max-age. Internal service-to-service traffic runs over a private network (Tailscale) or, for cross-boundary hops, over TLS.

At rest. The primary application database is encrypted at rest at the storage layer. Sensitive per-tenant secrets (API keys, integration credentials, AI-provider keys) are additionally encrypted at the application layer with an envelope key that never leaves the platform.

Tenant isolation

Multi-tenancy is enforced primarily by PostgreSQL row-level security (RLS). Every tenant-scoped table carries a tenantIdcolumn and an RLS policy that filters queries against a session-scoped tenant identifier set by the API layer. Raw Prisma reads silently return zero rows when the tenant claim is missing — so a bug in application code fails closed rather than open. The control-plane surface (/system) is the only surface that may cross tenants, and it does so through an explicit fan-out API rather than by disabling RLS.

Identity and access

  • Identity is handled by Keycloak. Passwords never enter the application database; MFA secrets never enter the application database.
  • MFA is available on every account and mandatory for administrator roles at every tenant.
  • Authorization is capability-based: every API route declares the capabilities it requires, and the guard is enforced server-side.
  • Administrator sessions time out after a configurable period; every admin action writes to the audit log.

Audit log

Privileged actions (user role changes, permission grants, exports, commerce events, billing changes, credential access) are written to an append-only audit log with actor, resource, timestamp, and a content hash of the previous entry — making an entry undetectably alter-able without invalidating the chain. Admins can export the log for their tenant. The control-plane team can query across tenants for incident response, and those queries themselves are audited.

Vulnerability management

  • Dependency scanning runs on every build; high and critical CVEs block merges.
  • Coordinated disclosure: security researchers can reach us at [email protected]. We commit to acknowledge within 3 business days and to keep the reporter informed as we validate and remediate.
  • Third-party penetration testing is scheduled on an annual cadence, with results shared with enterprise customers under NDA.

Backup and recovery

The primary database is backed up daily, with point-in-time recovery for the last 7 days. Backups are stored off-host and encrypted. Restoration is exercised on a schedule against a staging environment; target RPO is 15 minutes, target RTO is 4 hours.

Availability

Production runs behind a Cloudflare edge, with the API tier horizontally scaled (currently three replicas behind a least-conn load balancer). See the Status page for the current operational picture.

Third-party sub-processors

The complete list of sub-processors that touch customer data is maintained in the Data Processing Agreement. Each sub-processor operates under a written contract and is selected in part for the security posture it maintains (SOC 2 / ISO 27001 for infrastructure providers).

Incident response

We commit to notifying affected controllers of a personal-data breach within 72 hours of becoming aware of it, with a description of the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the measures taken. Details are in the DPA.

Compliance posture

SOC 2 preparation is in progress; we do not currently hold a SOC 2 or ISO 27001 attestation. Malaysia PDPA 2010 obligations are met and, for EU customers, we operate under Standard Contractual Clauses via the DPA. See the Compliance page for the full picture.

Reporting a security issue

Email [email protected]. Please do not include personal data or reproduction steps that involve third-party accounts. We do not run a paid bug-bounty programme yet, but we credit researchers who report responsibly.