Security

Last updated: 2026-08-25

This page describes the technical and organizational security measures skink applies to protect customer data and the Service.

Application Security

• Credentials such as API keys are hashed and never stored or shown in plain text after creation. Keys can be revoked at any time and are rate-limited.
• Every request is authenticated.
• All input is validated before it's processed.
• Billing and credit changes are handled safely to prevent double-charges or incorrect balances.
• Payment events are verified before any billing action is taken on them.

Data Security

• Submitted email addresses are stored in readable form by default, encrypted at rest (AES-256-GCM, per our Data Retention page). Customers can switch to hashed-only storage in Settings from day one, and control how long records are kept, up to 365 days.
• In transit: all traffic to the public API and dashboard is served over HTTPS. We enforce HTTPS-only return URLs and send an HSTS header (max-age=31536000; includeSubDomains). TLS configuration meets current industry recommendations; detailed technical specifications are available for procurement review under NDA at security@skink.dev.
• At rest: submitted addresses are stored encrypted at rest by default (AES-256-GCM); a hashed-only storage mode is available as an account setting; and all backups are encrypted at rest using AES-256 or equivalent.
• Access to stored data is restricted on a least-privilege basis, and credentials are never committed to source control.
• Records are automatically deleted on schedule, per our Data Retention policy.

Infrastructure Security

• Only the access required to run the Service is open; everything else is restricted.
• Dependency and security updates are reviewed before deployment.
• Systems are isolated so an issue in one part of the Service can't affect the availability of another.
• Database backups are taken on an hourly rolling schedule from two independent layers, kept both on-server and off-site, and encrypted at rest. See our Data Retention page for the exact retention durations and how backups interact with deletion requests.
• Automated uptime monitoring alerts us within minutes of a service disruption.

Secrets Management

API keys, database credentials, and third-party provider tokens follow a documented rotation policy with a named owner.

Vulnerability Disclosure

Security researchers and customers can report potential vulnerabilities to security@skink.dev. We acknowledge reports promptly and aim to remediate confirmed issues on a timeline proportionate to severity. We do not currently operate a public bug-bounty program; reports made in good faith are welcome without one.

Incident Response

We follow a detection → containment → notification flow for security incidents. Detection: automated uptime monitoring and application/rate-limit logging alert us within minutes of abnormal behavior. Containment: suspected abuse or unauthorized access is contained by suspending affected accounts/keys, restricting egress, and rotating credentials. Notification: a personal-data breach affecting controller data is reported to the controller without undue delay and within 72 hours (DPA §8); incidents reportable under the Indian CERT-In Directions, 2022 are reported to CERT-In within 6 hours; where we act as controller (account data), affected individuals and supervisory authorities are notified as required by applicable law. During any declared incident or investigation, we preserve the logs relevant to that incident beyond their normal rotation for the duration of the incident and any resulting investigation or legal hold.

Outside of a declared incident, operational logs are retained on a rolling basis, including a 180-day security-log window consistent with applicable Indian cybersecurity retention requirements.

Provider Account-Existence Techniques

skink's catch-all resolution uses provider-specific signals solely to determine mailbox deliverability for addresses our customers ask us to verify. This is rate-limited, used only in service of a deliverability verdict, and is not offered or marketed as a standalone enumeration or discovery service.

Law enforcement and government requests

skink reviews government requests for legal validity and scope before responding. We disclose only data we are legally required to provide, and where legally permitted we notify affected customers. Our data-minimization practices — short default retention, a hashed-only storage option, zero-retention verification, and per-verification deletion — mean we often have less information available to disclose than a provider that retains data indefinitely by default. Request counts are published in our transparency report at /transparency.

Certifications

skink does not currently hold SOC 2, ISO 27001, or a HIPAA compliance attestation. We will not display certification badges or make compliance claims that aren't backed by a completed, independent audit. The practices described on this page — encryption, least-privilege access, key rotation, and automatic retention purging — reflect our current security posture and form the basis for pursuing a formal certification when customer requirements warrant it.

Contact

Security questions or reports: security@skink.dev.