Separate public and customer access
The public website cannot read customer Gen9 records. Authenticated customer requests pass through a separate server-side access layer before approved job information is returned.
Security
Layered access. Honest security information.
No website is hack-proof. This page describes controls that are implemented in the current SkyBridge architecture and the safe actions expected from customers; it does not claim immunity from attack.
Server-side authorisation
Customer access checks the signed-in identity, active account membership and authorised job. Internal customer-service actions use action-specific staff permissions rather than relying only on hidden buttons or page navigation.
Private data layer
Direct customer access to underlying customer entities is denied. The customer gateway returns only the approved fields required for the requested account and job, and customer responses are marked not to be cached.
Document access
Documents are linked to an authorised account and job. Upload requests restrict declared type and size, and approved downloads use short-lived links. Customers should still upload only files specifically requested through the portal.
Public quote protection
The public quote endpoint validates and bounds submitted fields, uses a hidden anti-bot field, applies request limits and supports idempotency so an accidental retry does not create a second request. Sensitive job documents are not accepted through this form.
Transport and account safety
Use the HTTPS site and do not share portal credentials. Each staff member should have an individual account. Tell SkyBridge promptly when a user should lose access or if an invitation, account, message or document appears unexpected.
Current assurance boundary
Security controls reduce risk but do not eliminate it. Capabilities such as malware scanning, operational alerting, tested restoration, penetration testing and provider resilience are disclosed only after they are implemented and evidenced.
Report a security concern
Use the Contact page to request the approved security-reporting channel. In the first message, describe the affected page and time without sending passwords, identity documents, payment evidence, live customer records or exploit instructions.
To request the approved security-reporting channel, contact SkyBridge.