Your data and security

skyseat is in early access. This page says what is true today; what is still missing, we say too. The Trust center has the full picture.

Where your data is

• The platform and your employees’ computers run on servers in the European Union, with a daily encrypted backup; what you delete disappears from the backups within 63 days at most.
• The panel uses no advertising or analytics cookies and loads nothing from third parties. It uses only the cookie for your session.

Providers involved

To do their work, some data goes to these providers, several in the United States: Anthropic (the AI model), ElevenLabs and Twilio (voice and phone, only if you turn them on), Better Stack (technical server logs), Google Workspace (the platform’s emails) and your browser’s notification services (the notification is encrypted). The complete list is on our subprocessors page. Accounts you connect yourself (Google, Microsoft, Slack…) stay yours and follow their own terms.

Who sees what

• Each company sees only its own data.
• Each person has a role: Administrator (everything), Manager (answers requests and assigns tasks) or View only.

Passwords and accounts

Accounts are connected once and you decide which ones each employee uses. Their keys are stored encrypted (AES-256-GCM) in your company’s vault and never pass through chat or the Log. Verification codes you give from the Inbox are used once and not stored. An employee’s computer never sees the keys.

Everything is logged

The Log shows what each employee and each person did, with time and source. It cannot be changed and you can export it. You can also download an audit file (PDF, CSV or JSON) whose rows are chained with hashes, so any tampering is detectable. It helps you document your processing for the EU AI Act and GDPR; it is not a certification.

Your data and leaving

• Download your data or your company’s data from Account › Data & privacy.
• Delete your account, or close your company: you have 30 days to cancel before everything is erased for good.
• Dismissing an employee removes its access immediately; a copy of its computer is kept for 30 days and then deleted.

If there is a breach

If a failure or an attack affects your data, we tell you within 48 hours at the latest of detecting it, with what we know at that time. That leaves you 72 hours to notify the data protection authority, if needed, and we help you notify those affected. It is explained in the data processing agreement.

The legal texts, privacy, terms and the data processing agreement, are drafts pending legal review.