Trust you can check, including what we do not claim.
Security controls, privacy rights, data hosting and live service status in one place. Each statement matches a policy page or a live endpoint, and gaps are listed openly.
Service status right now.
What we rely on today.
Server-enforced access
Protected APIs validate sessions and roles on the backend, not only in the browser.
Security detailsShort-lived sessions
Access JWT expires in 15 minutes. Refresh tokens last 30 days and rotate. Not a 24-hour access token.
Optional two-factor
Optional TOTP 2FA and server audit events. No SSO, no claimed field-level encryption, no published residency SLA.
PIPL-aligned consent
A dedicated PIPL notice, bilingual consent flows, a named DPO contact and user-facing export and deletion.
Read the PIPL noticeHosted in Hong Kong
Production web and backend run on Tencent Cloud Hong Kong, with identical content on .cn and .com.cn. We do not publish a data-residency SLA.
Cross-border sectionCookie transparency
The cookie policy lists what is set and why, and consent is recorded.
Cookie policy
What we do not claim.
Large vendors list certifications. We list the ones we do not have, so you can plan around them.
- Not SOC 2 certified. No published audit engagement or quarter.
- No single sign-on (SSO) today.
- No claim of field-level encryption.
- No published data-residency or uptime SLA.
- Detector scores are not identity verification.
Policies and notices.
Security and privacy FAQ.
Where is my data stored?
Production runs on Tencent Cloud Hong Kong. The PIPL notice explains cross-border handling for users in Mainland China.
How do I report a security issue?
Email security@skillswipe.cn with steps to reproduce. Please do not include personal data of other people.
How do I ask for my data or its deletion?
Use the in-app controls, or email privacy@skillswipe.cn or dpo@skillswipe.cn. The privacy policy lists your rights.
Can I get a DPA or sub-processor list?
A signed DPA and sub-processor disclosures are available on request through the contact page.
Need a security review?
Ask for the DPA, sub-processor list or a security conversation through the contact page.