# Skybber Platform Compliance

**Version:** 1.2.0  
**Published:** 2026-08-10  
**Machine-readable bundle:** [/.well-known/compliance.json](/.well-known/compliance.json)  
**Schema:** [/.well-known/compliance.schema.json](/.well-known/compliance.schema.json)

---

## Vendor

| Field | Value |
|---|---|
| Product | Skybber |
| Operator | Richard Myers (sole proprietor / Einzelunternehmer) |
| Registered address | Munich, Germany |
| Privacy policy | https://skybber.com/legal/privacy |
| Terms of service | https://skybber.com/legal/terms |
| DPA template | https://skybber.com/legal/dpa |
| Sub-processor list | https://skybber.com/legal/subprocessors |
| Privacy contact | privacy@skybber.com |
| Security contact | security@skybber.com |

> The four `https://skybber.com/legal/...` addresses above are the **planned** locations of the public legal documents. They are not live yet — `skybber.com` (and `www.skybber.com`, an identical copy) serves this compliance bundle, `security.txt` and the landing page, but the `/legal/...` pages themselves are not published. Until they are, the privacy policy and terms of service ship with the app, and a DPA or the sub-processor list can be requested at privacy@skybber.com. No claim in this document uses one of those addresses as its evidence.

---

## Regulatory Frameworks

### GDPR — EU/EEA users and customers

**Overall status:** implemented

| Control | Status | Verification | Notes |
|---|---|---|---|
| Art. 15 — Right of access | implemented | `GET /api/users/me/export` | Last reviewed 2026-05-03. |
| Art. 17 — Right to erasure | partial | `DELETE /api/users/me` | Verified: the endpoint suspends the account immediately and schedules hard deletion after a 7-day grace period; a nightly job runs the cascade. **Implemented but not yet verified end-to-end on the current infrastructure:** the worker step that removes the corresponding identity from the self-hosted identity provider. That step is deliberately best-effort — a failure is logged, not retried — so until it is exercised and confirmed, an identity record may outlive the deleted application data. Full tenant cascade Phase 3. Last reviewed 2026-05-03. |
| Art. 20 — Data portability | implemented | `GET /api/users/me/export?format=json` | Last reviewed 2026-05-03. |
| Art. 28 — Processor obligations | partial | Privacy policy §8 "Data Sharing and Third Parties" | Sub-processors are disclosed in the privacy policy. No customer-facing DPA template has been published yet, and the privacy policy records that documented confirmation of the concluded agreements with the infrastructure, moderation and maps providers is still outstanding. A DPA can be requested at privacy@skybber.com. Last reviewed 2026-08-10. |
| Art. 30 — Records of processing | implemented | `GET /api/tenants/{id}/audit` | Audit log and structured event emission per tenant. Last reviewed 2026-05-03. |
| Art. 32 — Security of processing | partial | Encryption section below; privacy policy §14 "Security Measures" | In place: encryption in transit, encryption at rest on the databases and on the Object Storage buckets, least-privilege access, and a database reachable only over a private network (no public endpoint). Remaining open item: the provider's scheduled logical database backups are not encrypted — see Encryption → At Rest. Architecture documentation is not public; available on request under NDA. Last reviewed 2026-08-11. |
| Art. 33 — Breach notification | policy | Privacy policy §15 "Data Breach Notification"; Incident Response below | The 72-hour supervisory-authority notification commitment is documented. No breach-response rehearsal has been carried out; the service is pre-launch. Last reviewed 2026-08-10. |
| Art. 44 — International transfers | implemented | Privacy policy §9 "International Data Transfers" | All platform data stays in Scaleway fr-par (EU); the only third-country flows are the OpenAI text-moderation call, Google Maps/Fonts when the map feature is used, and legally mandated CSAM reports — each covered by SCCs or a legal obligation, listed individually in §9. Last reviewed 2026-08-10. |

> **On verification links.** Entries above cite either an API endpoint or a section of the privacy policy that ships with the app. The public web copies of the legal documents (`https://skybber.com/legal/...`) are **not live yet**, so they are not cited as evidence here. A date in "Last reviewed" means someone followed the evidence cited in the same row on that date.

### CCPA — California residents

**Overall status:** policy  
Privacy policy includes 'Do Not Sell or Share' notice; right-to-know and right-to-delete are handled via the same endpoints as GDPR Art. 15 and 17.

### SOC 2 Type II — Service Organization Controls audit

**Overall status:** not yet certified  
On roadmap; targeted for first enterprise customer requirement.

### ISO 27001 — Information Security Management System

**Overall status:** not yet certified  
On roadmap; not currently a customer requirement.

---

## Data Residency

**Default region:** EU — Scaleway `fr-par` (Paris, France)

| Region | Provider region | Status |
|---|---|---|
| EU | Scaleway `fr-par` (Paris, France) | Generally available (default) |

**Guarantee:** All live platform data (Postgres rows, Object Storage objects, Keycloak identities, queue messages, secrets) is stored in Scaleway `fr-par`. No non-EU region is configured and live data is not replicated across regions.

**One deliberate exception:** the scheduled logical backups of both PostgreSQL instances are stored *offsite* rather than in `fr-par` (`backup_same_region = false`). Scaleway selects the destination region; it has not been independently confirmed, and per Scaleway's documentation logical backups are not covered by the database volume encryption described below.

**Verification:** infrastructure-as-code review of the OpenTofu roots — every Scaleway resource is created with `region = "fr-par"` (zone `fr-par-1`) and no second region is configured anywhere. Reviewed against the configuration, not against the live console. The configuration is not public; available on request under NDA.

**Last reviewed:** 2026-08-10

---

## Encryption

### At Rest

| Data store | Method |
|---|---|
| Managed PostgreSQL (application database and identity database) | Volume-level LUKS encryption using `aes-xts-plain64` with `sha256` and a 512-bit key (2 × 256-bit, as XTS mode requires), key managed by Scaleway. Enabled explicitly on both instances in infrastructure-as-code (`encryption_at_rest = true`), not left to a default. Per Scaleway's documentation this covers all databases, data including logs, and snapshots; scheduled logical backups are **not** covered. |
| Object Storage (media, exports) | Bucket-level server-side encryption (SSE-ONE) with Scaleway-managed AES-256 keys, one per object, enabled on both buckets as default bucket encryption. Declared in infrastructure-as-code and confirmed against the live buckets on 2026-08-11: each bucket returns the rule, and an object written afterwards reports `ServerSideEncryption: AES256`. Default bucket encryption governs objects written after it is set; both buckets held zero objects when it was enabled, so no stored object predates it. SSE-KMS and SSE-C are deliberately not used — SSE-C would break browser presigned uploads, and SSE-KMS adds a customer-managed key whose loss would make the objects unreadable, for a guarantee this claim does not need. |
| Secret Manager (credentials, IdP secrets) | Envelope encryption with AES-256 under Scaleway's internal hierarchical key-management system: per-secret data-encrypting keys wrapped by key-encrypting keys, themselves protected by a root key held in an offline vault. Keys are Scaleway-managed; no customer-managed key is configured. |
| Kubernetes node volumes (container filesystems) | **Not verified.** Scaleway does not document encryption at rest for Block Storage volumes, and no volume-level encryption is configured by us. No persistent platform data is held here: the workloads mount no persistent volume claims, and all state lives in PostgreSQL, Object Storage or Secret Manager. |

*Sources for the mechanisms above are Scaleway's own product documentation (Managed Database encryption at rest, Object Storage server-side encryption, Secret Manager secret encryption). Where Scaleway documents no mechanism, this table says so rather than inferring one.*

### In Transit

| Channel | Method |
|---|---|
| Public endpoints | TLS 1.2 minimum, TLS 1.3 preferred (Let's Encrypt certificates via cert-manager) |
| Database connections | TLS over the private network |
| Inter-service (Kapsule workloads, Keycloak) | TLS |

### Bring-Your-Own-Key (BYOK)

Not supported in MVP. Planned for Phase 3 (enterprise).

---

## Sub-processors

### Platform (all tenants)

| Name | Purpose | Regions | Data scope |
|---|---|---|---|
| Scaleway SAS | Cloud infrastructure (Kubernetes compute, managed PostgreSQL, object storage, queues, secret manager, transactional email, container registry) | fr-par | All platform data |
| Keycloak (self-hosted) | Identity and access management, user authentication | fr-par | User credentials and identity claims — operated by us on Scaleway infrastructure, not a third-party processor |
| OpenAI | Text moderation API (posts and comments, reviewed before publication) | US | User-submitted text only; no account identifiers passed. Fail-closed: if unconfigured, no text is sent and the post is held for review |
| Amazon Web Services | Image moderation (Rekognition) only — **currently inactive** | EU region | Uploaded image content only; while unconfigured, uploads are rejected and no image is transmitted |
| Microsoft (per tenant via federation) | Optional: Identity Provider for tenants using Microsoft Entra ID | — | Claims only; Skybber data is not passed to Microsoft |

### Tenant-specific

Each tenant may add sub-processors through IdP federation. See `/api/tenants/{id}/compliance.json#subprocessors` for the IdP and any other tenant-elected sub-processors.

---

## Audit

**Platform audit logs**
- Available: yes
- Format: JSON / CSV export
- Default retention: 30 days
- Extended retention: Phase 2 (request via support)

**Tenant audit logs**
- Available: yes
- Endpoint: `GET /api/tenants/{id}/audit`
- Scope: Tenant admins see all admin actions in their tenant

---

## Incident Response

| Field | Value |
|---|---|
| Breach notification window | 72 hours from discovery |
| Communication channel | Email to all tenant admins and status page banner |
| Status page | https://status.skybber.com |
| Security contact | security@skybber.com |
| PGP key | https://skybber.com/.well-known/security.txt |

---

## Deletion and Portability

### Right to Erasure (GDPR Art. 17)

- **Endpoint:** `DELETE /api/users/me`
- **Behavior:** MVP: the account is suspended immediately, hard deletion is scheduled 7 days later, and a nightly job runs the cascade. Removal of the corresponding record in the self-hosted identity provider is implemented as a best-effort step of that job and **has not yet been verified end-to-end on the current infrastructure**. Full tenant cascade Phase 3.
- **Completion target:** 30 days

### Data Portability (GDPR Art. 20)

- **Endpoint:** `GET /api/users/me/export`
- **Format:** JSON (structured, schema versioned)

### Tenant Offboarding

- **Available:** yes (interim process during MVP)
- **Future endpoint:** `POST /api/tenants/{id}/request-deletion` (Phase 3)
- **Interim guidance:** Tenant admin disconnects IdP and contacts support; deletion is operator-driven during MVP.

---

*This document is a human-readable rendering of the machine-readable compliance bundle at [/.well-known/compliance.json](/.well-known/compliance.json). In case of discrepancy, the JSON is authoritative.*