How Skyform accesses, handles, and protects client environments and data. This page exists so you can forward it to your security team before the first call.
Customer environments are accessed on demand via least-privilege credentials you issue and control. Read-only IAM for AWS work. Scoped tokens for everything else. Access is granted per engagement and revoked when it ends.
Audit and assessment work runs on read-only access. Write access happens only where the engagement explicitly requires it, scoped to the resources in play and agreed in writing first.
No long-lived secrets sitting in a contractor's laptop. Credentials are time-bound where the platform supports it and removed at engagement close as part of the offboarding checklist.
Skyform's own AI advisor uses read-only cross-account IAM and keeps no customer data at rest. The full architecture is public: read the Ridgeline briefing.
A standard NDA is in place before any engagement starts. Customer data is accessed on demand inside your environment, not exported to ours. No customer data is retained outside the active engagement window unless contractually required, and the compliance posture is spelled out per engagement before kickoff.
Skyform has delivered for healthcare, financial services, and SaaS clients with compliance-sensitive workloads. Bring your control framework and the engagement posture is documented against it before work starts. BAAs and equivalent agreements signed when required.
For engagements above $50K, or for any client whose process requires it, Skyform signs your MSA with standard terms. Skyform carries commercial general liability at $1M per occurrence and $2M aggregate, technology E&O at $2M, and cyber liability at $1M through an A-rated carrier. Security questionnaire, certificates of insurance, and a reference list are ready on request. We've moved through Fortune 500 procurement before and don't slow it down.
IP is yours: everything built for you under a Skyform engagement (code, documents, designs, analysis) is your work product, owned by you as work made for hire when it's delivered. Skyform retains rights only to internally developed tooling such as Ridgeline that predates or is independent of your engagement.
Async-first delivery through a dedicated Slack or Teams channel with 24-business-hour response, same business day on retainer channels. Retainer clients with production incidents get a dedicated escalation path. Standard coverage is US Eastern and Central business hours, with native overlap for EMEA and APAC.
Send them this page, then send us the questionnaire. It comes back filled out, with the NDA signed first if you want it that way.