Security, data handling and procurement
One page for purchasing, legal and IT: who you contract with, which documents exist today, where your data lives, how access is protected — and what we do not offer yet.
Company and contracting party
Skalnav GmbH i.Gr., Braunschweig, Germany — founded; entry in the commercial register pending; company details in the Impressum. Contact: contact@skalnav.com. Licences are arranged directly with us and activated manually; there is no online checkout — see How to buy.
Documents for purchasing
Available today
- A written quotation and a written order confirmation (term, named users, licence scope)
- An NDA for confidential engineering data
- Answers to supplier-qualification and security questionnaires
- The security and data-handling summary (this page)
- The platform terms (AGB, in German) and the cancellation page
- A public sample report
Not currently available
- A VAT ID (added once assigned — see Impressum)
- A signed data-processing agreement for customers under Art. 28 GDPR (in legal review)
- An export-control classification of the software (under legal review)
- An annual framework agreement
- English translations of the terms
- Certifications such as ISO 27001 or SOC 2, or an external penetration-test report
- A contractual uptime SLA or any availability commitment
Where your data lives
Hosted by IONOS SE on a single server in Germany. Every website and app asset is self-hosted: no third-party CDNs, trackers or analytics, and no processing of your data by third-party AI services.
Transport and browser security
HTTPS/TLS with HSTS, a Content Security Policy, frame protection and a strict CORS allow-list.
Accounts and sign-in
Passwords are hashed with bcrypt (cost 12). Access tokens are short-lived (15 minutes); the refresh token sits in an HttpOnly, Secure, SameSite=Strict cookie and rotates, with replay detection, and you can sign out on all devices. Multi-factor authentication (TOTP, with recovery codes) can be enforced for a whole organisation.
Access control and isolation
Plan and design-basis decisions are made on the server. Access is checked per account and per live organisation membership and role (Viewer, Auditor, Engineer, Admin, Owner). Organisation data and the report archive are scoped per organisation; row-level isolation is tested. An audit trail records membership, security and report-issue events.
Your data
You can export and delete your account data yourself (GDPR). Logs are minimised for personal data; sign-up, sign-in, password-reset and cancellation events in the application logs record e-mail addresses only as a hash. Calculation parameters are logged for a limited period, as the privacy policy states.
Operations
Encrypted off-site backups with integrity checks and restore tooling. A synthetic restore drill was run on 11 September 2026; the drill with the real off-site archive is still pending, and a restore-time objective (RTO) is not yet established.
Software supply chain
A dependency audit runs as a CI gate — high and critical findings block a release — and every release has a software bill of materials (SBOM). The proprietary knockdown internals are not shipped to the browser.
What we do not offer yet
| What | Status |
|---|---|
| Single sign-on (SAML/OIDC) and SCIM | not currently available |
| An external penetration-test report | none yet |
| High availability or disaster recovery | not in place |
| On-premise or air-gapped installation | not currently available |
| A contractual uptime SLA or any availability commitment | not currently available |
| A dedicated support engineer | not currently available |
| Certifications such as ISO 27001 or SOC 2 | none |
| A full security whitepaper (technical and organisational measures) | in preparation |
What a Design Partnership includes today, and how each of these is handled: Enterprise.
Export control
Registration is not available from EU-sanctioned countries; access is screened by country at registration. The export-control classification of the software is under legal review. Please do not upload classified or export-controlled data without agreeing it with us first.
Support
Every commercial licence includes e-mail support (contact@skalnav.com), best effort — there is no response-time commitment and no SLA. Enterprise Design Partners also get a named technical contact and an agreed onboarding package.
Results, exports and your first step
- Every result and report carries the engine version (build and knockdown-schema reference), and archived reports can be re-checked against today’s engine.
- Your PDF, Word, CSV and JSON exports are yours.
- If you do not renew, your account stays open on a free tier and your data is not deleted; you can export or delete it at any time.
- First-use risk stays small: start with a Proof of Value on your own case, or an Independent Buckling Review bought as a simple purchase order.
Need a document or a questionnaire answered?
Tell us what your purchasing, legal or IT process needs. We answer from what exists today and say plainly what does not.