Security
You're trusting us with the systems that run your estate. Here's how we treat that.
Every Skyrsoft product is self-hosted and higher-trust than most software you run — a certificate authority, or the logon credentials on your fleet. This page states how each one handles that trust, accurately, including the uncomfortable parts.
Self-hosted
What stays on your servers, and what reaches us.
Every product runs on infrastructure you control. The databases are yours, agents talk only to your server, and what each product manages (certificates, private keys, credentials, the configuration of your systems) is never sent to Skyrsoft.
Once a licence key is applied, the server checks it with our licence service. Each periodic check carries identifiers and a single-use nonce. Activation also sends the licence key, which carries the licensee name and email address, plus the server's hostname, operating system and application version; Autologon Manager re-activates when its service starts after a normal shutdown. The licensing page lists every field and notes where the products differ.
A licence takes effect once the server has activated it with one successful check. After that, if the server can't reach us, nothing is revoked: it keeps its edition to the end of the term plus 30 days, and a renewal reaches it with its next successful check.
Secret handling
How each product protects what it holds.
Skyrsoft CertOps
- CA private keys protected with Windows DPAPI, machine-scoped so they are not portable off the host.
- Every agent call is mutual TLS against an internal CA, with instant allow-list revocation.
- Certificates for disabled Active Directory accounts are revoked and the CRL updated automatically.
- CRL and OCSP responders for validation, on both editions.
Skyrsoft Autologon Manager
- The auto-logon credential is encrypted at rest on both the server (DPAPI, machine-bound) and the endpoint (DPAPI plus SHA-256-derived secondary entropy).
- Agent client-certificate keys live in the Windows CNG machine key store, non-exportable, TPM-backed where available — not a file.
- Console passwords use PBKDF2-HMAC-SHA256 (210,000 iterations); all machine-to-server traffic is mutual TLS with certificate pinning.
Who can sign in to each console, and how, is documented per product, because the two are not the same: CertOps enforces three roles behind OIDC single sign-on, TOTP and passkeys, and Autologon Manager enforces two, with one identity provider active at a time. Where the Autologon Manager console gets its own TLS certificate — self-signed, its built-in ACME client, or one pushed in by an external manager — is set out under console TLS certificates.
Cryptography, in brief: TLS 1.2/1.3, mutual TLS with internal RSA CAs and certificate pinning, DPAPI / CNG for keys at rest, PBKDF2-SHA256 for console passwords, and constant-time comparison for API tokens.
Documented posture
We write down what we don't defend.
The strongest trust signal we can give is honesty about the boundaries. We state accepted limits as plainly as defended ones:
- Auto-logon means a live unattended session — that is the feature. Autologon Manager removes the plaintext stored password and the un-auditable manual sprawl, not the physical exposure of a machine signed in with nobody present.
- The server can decrypt what it authored. A management server that vaults or issues secrets is a tier-0 host by definition — treat it that way. An administrator with the right role can, where the product supports it, reveal a stored secret; the control is RBAC plus an audit trail, not structural secrecy.
- Shipping defaults are not hardened defaults. Each product ships with a documented hardening checklist; follow it. For CertOps that begins with restricting who can reach the console at all — a management IP allowlist, a persistent block list alongside sign-in rate limiting, and a password policy. We don't claim “hardened out of the box.”
Autologon Manager ships a written threat model that enumerates its defended and accepted boundaries explicitly.
Disclosure
Reporting a vulnerability.
Email security@skyrsoft.app — our machine-readable contact is at /.well-known/security.txt. We acknowledge reports within 24 hours and keep you updated. Act in good faith, give us reasonable time to remediate, and don't degrade service or access others' data. Full details are on the support page.
Assurance
What's done, and what's on the way.
Stated plainly, because “planned” and “done” are not the same thing:
- Independent security review — not yet completed. It's planned; we won't imply third-party validation we don't have.
- Compliance mappings — not yet published. Essential Eight, ISO 27001 and SOC 2 mappings are in progress; we'll link them here as each is completed.