Account and billing

Security and compliance

What Skrum implements, what you configure in your workspace, plus the DPA, data residency, audit trail, and ownership transfer flow.

Skrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.

Skrum is not SOC2 certified. This page describes the controls Skrum implements and the controls you configure in your workspace. No badges we did not earn.

What Skrum implements

Envelope-encrypted secrets at rest (AES-256-GCM, keyed by MASTER_ENCRYPTION_KEY).
Session-based authentication with optional TOTP two-factor.
Role-based access control with a tamper-evident, append-only tenant audit trail.
Rate limits on every mutation surface; pino redaction across every credential path.
Cross-account isolation returns 404, not 403 — the existence of a foreign resource is never disclosed.
Data Processing Addendum with click-acceptance and a downloadable receipt.
GDPR data-rights endpoints (export + delete with a grace window).
Sanctioned workspace ownership-transfer flow with step-up re-authentication.

What you configure in your workspace

Two-factor policy, session lifetimes, and the IP allowlist under Settings, Security.
SSO and SCIM provisioning on eligible plans. See SSO and SCIM setup.
Roles and permissions for every member and guest. See Roles and permissions.
Who may export the audit trail and who may accept the DPA.

Audit trail and residency

Audit trail. Settings → Compliance → Audit. Read + CSV/JSON export (the export gate is a tier feature). CSV cells are neutralized against spreadsheet formula injection.
Data residency. Skrum shows the region your workspace data is stored in.
DPA. Accept the current version from Settings → Compliance. The receipt is downloadable.