SKEPIS™ Client Portal
Your data
What we store, where it goes, and who else can see it. This describes the system as built — if you want a specific claim verified before submitting anything confidential, ask.
What we store about you
| Data | Why |
|---|---|
| Email address | Identifies your account and receives invoices |
| Company name | Engagements are business-to-business only |
| Password | Never stored. Only a PBKDF2-HMAC-SHA256 hash at a 600,000-iteration work factor, from which the password cannot be recovered |
| IP address and browser user-agent | Recorded against each sign-in session, and against each agreement you accept, as evidence of who agreed to what and when |
| Agreement acceptances | Which version of the MSA and of each engagement contract you accepted, with timestamp and IP |
| Engagement records | Quotes, fee splits, status history, and notes |
| Messages | Questions and discussion you send us through the portal, kept with the engagement they belong to. Not deleted or edited once sent |
| Notification preference | Whether you want an email when something happens on your engagement. Change it under Settings at any time |
Files you upload
Specifications you submit and deliverables we return are held in private object storage. They are not publicly addressable: there is no URL that serves them directly. Each download is authorized individually by a short-lived signed token issued to your session — five minutes for a download, ten to complete an upload — after which the link stops working.
Specifications and deliverables are kept in separate buckets, so a fault in one delivery path cannot expose the other. Under the MSA, everything you submit is treated as your confidential trade-secret information from the moment it is submitted.
Who else your data passes through
| Who | What they receive |
|---|---|
| Cloudflare | Hosts the site, the database, the file storage and the bot check. All data described here lives on their infrastructure |
| Stripe | Handles payment. Receives your email, company name, invoice amount and the engagement reference. Card details go directly to Stripe and never reach us — we never see or store a card number |
| Resend | Delivers our notification emails. Receives your email address and the text of those emails — which is deliberately nothing but "there is something to read, sign in". No fee, document name, or message text is ever put in an email, so nothing confidential passes through them |
Nothing is sold, and nothing is shared with anyone else. There is no analytics, advertising or tracking on this site, and the portal loads no third-party fonts or scripts beyond Cloudflare's bot check on the forms. Our notification emails carry no tracking pixel and no rewritten links: we cannot tell whether you opened one.
Who at SKEPIS can see it
The internal review interface is restricted to SKEPIS staff by Cloudflare Access, which requires a separate verified sign-in that is independent of your client account. Client accounts can only ever see their own engagements.
Deleting your data
Ask, and your account is deleted along with its engagements, submitted documents, messages and agreement acceptances. Files already in object storage are removed separately on request. Note that records of agreements you accepted, and invoices already issued, may need to be retained where law or accounting requires it.
This is a factual description of how the system handles data, not a privacy policy in the regulatory sense — it does not set retention periods or describe statutory rights. Contact contact@skepis.com with questions.