Trust & Security

Why This Page Exists

Buying or running a learning and certification platform means trusting someone with learner data, certificates, and sometimes commercial records. This page summarizes how Skillhabit approaches that trust—so you can decide with facts, not slogans.

Who This Is For

Administrators, security reviewers, procurement, and anyone asked “where does our data live?” or “are you ISO / GDPR ready?”

Part of the TicTac Group

Skillhabit is a TicTac Learn product and part of the TicTac Group. Information security and privacy practices for the platform sit with that organization. Legal documents (privacy policy, DPA, terms) live in the TicTac Trust Centre.

Europe First

Skillhabit is built Europe first, so customer data stays under EU protection:

• Skillhabit is owned entirely by EU entities
• The platform runs entirely in the European Union, including the primary data stores your workspace uses
• Where a service touches customer data, we only use services that are owned and operated in the EU—except optional AI authoring (see below)

That follows the reasoning of the Court of Justice of the European Union in Schrems II (Data Protection Commissioner v Facebook Ireland and Maximillian Schrems, Case C-311/18): personal data should stay under EU protection, not depend on third-country transfers that cannot guarantee an equivalent level of protection.

When you choose Skillhabit, you do not need to watch whether Atlantic privacy frameworks will be struck down again—as Privacy Shield was in Schrems II. Privacy is built into how the platform is owned, hosted, and run.

Optional AI authoring is a separate choice: you decide what prompts and files to submit, and that flow is described in AI Creation & Data Privacy.

Data Residency

Customer platform data is hosted in Sweden (primary site in Falkenberg, with backups in Stockholm for geo-redundancy). You cannot choose another region.

Subprocessors that process customer data for the core platform are based in the EU/EEA. The exception is optional AI authoring, which sends the prompts and files you submit to OpenAI and may involve a transfer outside the EU/EEA under Standard Contractual Clauses—see AI Creation & Data Privacy and the Skillhabit DPA in the TicTac Trust Centre.

Privacy-First by Design

Skillhabit is built so people can learn and administer without being interrupted by tracking prompts—and without advertising or profiling trackers in the background.

That is why the platform and these docs open without a cookie consent footer or dialog. We only keep what the product needs to work well: a sign-in session, optional preferences, aggregate usage to improve Skillhabit, and technical diagnostics for reliability. We do not run advertising, retargeting, or cross-site profiling cookies, and we do not sell ads from your learners’ behaviour.

Privacy for workspace data (accounts, learning records, certificates) is handled with clear Terms and Privacy notices in the product, plus the contracts and DPA in the TicTac Trust Centre. Binding legal wording: Privacy Policy.

What Data We Use, and Why

How We Inform Users About Data We Store

People should always be able to see what they are agreeing to when they use Skillhabit. We surface that at the moments it matters, and we keep the full legal text easy to open.

The Privacy Policy and Terms of Use describe what information Skillhabit processes and the rules for using the service. Contracts, DPA, and related package documents for controllers and processors live in the TicTac Trust Centre.

Skillhabit does not control how a customer organization uses the data in its workspace, and we are not responsible for that use. Each workspace decides what personal data it puts into Skillhabit, how it informs its own learners, and which policies apply to that learning program. Limit who can see PII with Users & Groups, managers, and App access.

For the specific policy of a given workspace—especially for people buying or requesting access through Academy—refer to that workspace’s Academy terms & conditions (the custom text customers accept at checkout, under Manage Academy → Payment). See Supported Payment Options.

GDPR

We design and operate Skillhabit for GDPR. Your organization is typically the controller; TicTac Learn AB acts as processor under a Data Processing Agreement (DPA) and processes personal data according to your documented instructions.

Skillhabit provides technical and organisational measures and in-product capabilities so you can fulfil data subject requests—including access, rectification, erasure, and portability—without relying on Skillhabit staff to change workspace data for you.

In case of a personal data breach involving data processed under the DPA, we notify you without undue delay and within 48 hours of becoming aware, with relevant information and assistance for your GDPR obligations.

Practical takeaways:

• Know who is controller vs processor for your use case
• Use the Trust Centre and Privacy Policy for Skillhabit’s privacy and DPA wording—those documents win over marketing pages
• For workspace-specific learner or buyer policy, use that workspace’s Academy terms & conditions
• Point learners and staff to the in-product Terms / Privacy links (signup, checkout, and the Your Apps menu when signed in) so agreement is never hidden
• Limit who can see PII with Users & Groups, managers, and App access

ISO 27001

TicTac Learn holds ISO 27001:2022 certification for information security management. That certification covers how we run secure operations for learning platform services—including Skillhabit.

Read the public announcement: TicTac Learn Achieves ISO 27001:2022 Certification.

Vulnerability Management

TicTac Learn maintains a continuous, ISO-aligned vulnerability management process covering the Skillhabit platform, third-party services we use, and managed endpoints.

• Findings are triaged with CVSS v3.1 severity
• Critical issues are remediated on short timelines (from 72 hours up to 14 days, depending on impact and available fixes); lower severities follow standard patch cycles
• We use automated code and dependency scanning, endpoint protection on managed devices, and yearly independent penetration testing of the production environment
• Penetration test findings are documented, risk-rated, tracked to remediation or compensating controls, and reviewed through our security process
• SLA exceptions require compensating controls and formal approval by the Information Security Officer

Certificate, statement of applicability, and summary information on penetration testing and vulnerability management are available to customers on request via the TicTac Trust Centre / your Skillhabit contact (see the Skillhabit DPA).

Secure Software Development

Skillhabit changes go through a documented secure development process: version control, peer review, automated tests, dependency management, and security testing before release. Risk is assessed for changes that affect personal data. Binding detail for processors sits in the DPA; this page is the customer-facing summary.

Logging and Monitoring

Security-relevant and operational events are logged centrally, monitored for unusual activity, and reviewed by Skillhabit staff when needed.

• Interactive / operational logs are retained for up to 30 days
• Archived logs are retained for more than one year
• Access to logs is limited to Skillhabit developers

Security Incidents

We maintain a documented incident response process covering identification, containment, eradication, recovery, notification, and post-incident review. Security-relevant events are monitored so we can detect personal data breaches within the DPA timelines.

Where a personal data breach involves data processed under the DPA, the customer is notified without undue delay and within 48 hours of Skillhabit becoming aware, with relevant information and assistance.

System Status

Check live availability for the application and API on the Skillhabit status page:

status.skillhabit.com

Subscribe there if you want alerts when something changes.

Where to Go Next

If your security questionnaire needs details beyond this page, start from the Trust Centre and ask your Skillhabit / TicTac contact for the latest package.