Security and trust
What we do to protect your institution’s data, stated plainly.
Each institution’s data is kept apart
Every institution is a separate tenant. The database itself enforces the separation with row-level security, and a request without a valid institution sees nothing.
Encrypted in transit
Every connection to Shikon uses HTTPS. Sign-in, the portal and every product are served over TLS.
Sign-in is separate from this website
You sign in on Shikon ID. This marketing site never stores a login, and the customer portal runs on its own address.
Strong sign-in
Passwords are stored with Argon2id. Two-step verification with an authenticator app is required for all Shikon staff and for your institution’s administrators.
Staff access needs your approval
Shikon staff cannot open your institution’s records by default. Support access is time-limited, read-only unless you agree otherwise, and needs your approval.
A tamper-evident audit log
Licence, access and administrative changes are written to an append-only audit log in which each entry is chained to the one before it.
Demos never touch real data
Demo schools use generated sample data. SMS, email and payments are switched off in every demo.
Certifications
Shikon does not hold security certifications such as ISO 27001 or SOC 2 today. If that changes, we will say so here.