Skip to content
Skill Reality
Request a demo

Trust Center

Security and privacy, in plain terms

How Skill Reality handles the images, records and accounts from your floor. Anything we have not published yet is available on request.

Download the overview (PDF)Report a vulnerability

At a glance

Six things to know

  • One image at critical steps

    The glasses camera captures a single image only at the steps you mark critical. No continuous video is recorded.

  • Faces blurred on the device

    Faces are blurred on the device, before the image is uploaded. Kept images stay blurred.

  • Retention set by you

    You choose how long verification images and records are kept.

  • Encrypted in transit and at rest

    Procedure data and step logs are encrypted in transit and at rest.

  • Built on Microsoft Azure

    The Skill Reality platform runs on Microsoft Azure in Canada.

  • Single sign-on

    Sign in with Microsoft Entra ID, Google Workspace or Okta.

How data flows

From the glasses to your dashboard

How data flowsGlasses capture one image at a critical step. Faces are blurred on the device, before upload. The phone app relays the blurred image to the Skill Reality cloud on Microsoft Azure, where the AI checks the step and the image is stored for the retention period you set. Authorised users see records in the dashboard through role-based access and single sign-on.GlassesWorkerPhone appPaired deviceCloudMicrosoft AzureDashboardYour teamCapture and blurOne image; faces blurredon the deviceRelaySteps and blurred imagesto and from the cloudCheck and storeAI checks the step andstores the blurred imageAccessRole-based, withsingle sign-onHow data flowsGlasses capture one image at a critical step and faces are blurred on the device before upload, the phone app relays the blurred image, the cloud on Microsoft Azure checks the step and stores it, and your team sees records in the dashboard with role-based access and single sign-on.GlassesOne image; faces blurred on devicePhone appRelay: steps and blurred imagesCloud · Microsoft AzureAI check; blurred image storedDashboard · your teamRole-based access, single sign-on
Faces are blurred on the device, before the image is uploaded. Retention is set by you. The platform runs on Microsoft Azure in Canada. AI processing happens in the United States, so the SOP text and critical-step images sent for AI processing leave Canada.

What we collect and why

Only what the record needs

DataWhyHow long it is kept
Verification imageTo check that a step you marked critical was done right.Blurred on the device before upload; kept for as long as you set.
Step record: worker, procedure, step, time and resultYour audit, quality and training record.For as long as you set.
Account: name and work email, from your sign-in providerTo sign workers in and record who did each step.For the life of the account, plus 30 days.
SOPs and procedures you upload to ForgeTo build the guided procedures.Until you delete them. Deleted with the account.
Remote expert videoLive help from an expert who sees what the worker sees.Not recorded. Sessions are live only; nothing is stored.

What we do not collect

  • No continuous video from the glasses.
  • No audio recording for verification.
  • No images outside the steps you mark critical.

Camera and worker privacy

For the people wearing the glasses

The camera captures one image only at the steps your team marks critical. Faces are blurred on the device before the image is uploaded, and there is no continuous video. We wrote a plain-language page for workers, their union and HR, with a one-page sheet for the break-room board.

Read worker privacy

Infrastructure and access

Where it runs and who can see it

Hosting
Microsoft Azure
Azure region
Canada
Encryption
Procedure data and step logs are encrypted in transit and at rest.
Encryption detail (protocols, key management)
TLS 1.2 or higher in transit. AES-256 at rest, with Microsoft-managed keys.
Access control
Role-based: workers and managers see only what is relevant to their role.
Single sign-on
Microsoft Entra ID, Google Workspace, Okta
Deletion timeline after a retention period ends or a contract ends
Data is deleted within 30 days after the retention period ends or the contract ends. Backups are purged within 90 days.

Subprocessors

Companies that process data for us

SubprocessorPurposeUsed forData location
Microsoft AzureHosting, processing and storage for the Skill Reality platformPlatformCanada
LiveKitLive video for remote expert sessionsPlatformLiveKit Cloud, North America
OpenAIAI model provider (ChatGPT models)PlatformUnited States, under its standard API terms
AnthropicAI model provider (Claude models)PlatformUnited States, under its standard API terms
VercelHosting for this website (skillreality.com) and its forms only; no customer plant dataWebsiteUnited States (Washington DC, iad1)
ResendEmail for this website's forms only; no customer plant dataWebsiteUnited States (us-east-1)

Website subprocessors handle this website and its forms only, not data from your floor.

AI model providers

What AI providers receive
The text of your SOPs, for Forge to parse, and the single critical-step image, with faces already blurred on the device, for verification. Nothing else.
Where AI processing happens
In the United States. Data sent for AI processing leaves Canada.
Training on your data
OpenAI and Anthropic do not use data sent through their APIs to train their models by default, under their standard API terms.
OpenAI: retention
Up to 30 days in OpenAI's abuse monitoring logs, under its standard API terms.
Anthropic: retention
Available on request

Compliance roadmap

What is planned and what you can ask for

  • SOC 2

    Planned Type I planned for Q4 2027. We complete security questionnaires today.

  • Independent penetration test

    Planned

  • Data processing agreement (DPA)

    In preparation Contact security@skillreality.com.

Report a vulnerability

Found a security issue?

Email security@skillreality.com with what you found and the steps to reproduce it. We read every report and reply.

Please give us reasonable time to fix an issue before you disclose it, and do not access data that is not yours or disrupt the service while testing. Our contact details are also in security.txt.

Downloads

Take it with you