تجاوز إلى المحتوى الرئيسي

Trust Center

Trust Center

Skyhigh Security is committed to maintaining strong protections for our customers, products, and organization. We strive to earn your trust through transparency, accountability, and secure-by-design solutions.

Skyhigh Security Trust Center

Protecting organizations' data across hybrid environments

Skyhigh Security's mission is to protect organizations' data — including users, devices, and applications — across hybrid environments. They focus on data security beyond simple access control, aiming to secure data usage across the web, cloud, and private apps through their Security Service Edge (SSE) platform.

How We Protect Our Customers

Explore the foundations of our security, privacy, compliance, and AI governance programs.

Comprehensive certifications and regulatory compliance attestations to meet global requirements.

Monitor real-time service availability and explore our global infrastructure footprint.

Skyhigh Security's Fair Use Policy is designed to prevent service degradation and ensures equitable access to cloud resources.

Information about the data we collect and our commitment to using it responsibly across all Skyhigh products.

Legal agreements, terms of service, and related documentation governing use of Skyhigh Security products.

Our AI Approach: Principles, Products, and Trust. In an increasingly complex digital landscape, Artificial Intelligence (AI) stands as a pivotal force in enhancing cybersecurity defenses. We are at the forefront of integrating advanced AI capabilities into our product portfolio, driven by a profound commitment to responsible innovation, transparency, and the highest standards of data privacy and security.

Our Vision for AI in Cybersecurity

We see AI as a transformative force in how organizations combat evolving cyber threats. Our strategic goal is to utilize cutting-edge AI and Machine Learning (ML) to achieve significantly faster threat detection, provide thorough context for security incidents, and accelerate the investigation process. This strategy aims to improve the effectiveness and scope of security operations while also streamlining workflows, thereby reducing operational costs and the specialized skills traditionally needed to counter sophisticated attacks.

Guiding Principles for Our AI Development and Deployment

Our dedication to responsible AI is formalized through a comprehensive AI approach that establishes strict guidelines and best practices for all AI activities within the company. This policy applies to all employees, contractors, and partners interacting with our AI systems. It ensures that every AI initiative aligns with our core values, adheres to all legal and regulatory requirements, and prioritizes the safety and well-being of all stakeholders.

Responsible AI Use

We are committed to the ethical development and use of AI systems in a way that prioritizes fundamental human rights and societal benefits, and prevents harm.

Compliance with Laws and Regulations

We comply fully with all relevant AI laws and regulations, including those related to data protection, privacy, and intellectual property.

Transparency and Accountability

To ensure stakeholders understand AI's role in decision-making, we maintain a centralized 'AI System of Record' for comprehensive oversight. We and our employees are accountable for outcomes resulting from AI.

Data Privacy and Security

Our AI systems strictly adhere to company data privacy and security policies. This includes de-identification of personal or sensitive data where necessary, and ensuring its secure storage.

Bias and Fairness

We actively work to identify and reduce biases in AI systems to ensure fairness, inclusivity, and non-discrimination.

Human-AI Collaboration

We acknowledge AI's limitations and recognize its function as enhancing human decision-making, not substituting it. Human judgment remains the ultimate authority in understanding and acting on AI-provided recommendations.

Training and Education

All employees interacting with AI systems receive thorough training on responsible and effective use, staying updated on advancements and ethical considerations.

خدمات الطرف الثالث

We conduct thorough due diligence on third-party AI service providers to make sure they meet the same stringent ethical standards and legal obligations that we adhere to.

Basic Policies

Information Security Management System

The Skyhigh Security ISMS is at the core of our global information security program. It ensures a risk-based approach for the selection, implementation, and monitoring of security controls. Baseline controls are based on NIST SP 800-53 rev. 5, with additional frameworks for specific environments including FedRAMP, SSAE18, and others.

Information Technology Policies

Internal policies and procedures govern the implementation, monitoring, and effectiveness of security controls. Governance is maintained through management system reviews and operational control monitoring. Our ISMS aligns with and is certified to ISO/IEC 27001:2022 specifications.

Policy Excerpts

Independently Verified Security

Skyhigh Security maintains a comprehensive set of industry certifications and compliance attestations, including FedRAMP High Authorization, SOC 2 Type II, CSA STAR, ISO 27001, GDPR, and DORA. These independent validations demonstrate our commitment to meeting the most rigorous security and privacy standards required by enterprise and government organizations worldwide.

View all certifications →

Shared Responsibility Model

Unlike traditional on-premises data centers where full control resides with the customer, the cloud shifts security obligations to specific operational areas. Skyhigh Security takes responsibility for the Security "of" the Cloud — operating all components from host OS and virtualization to physical facility security.

Skyhigh Responsibility

Security "of" the Cloud
  • Infrastructure: Physical, network, and software infrastructure
  • Platform Uptime: Protecting against threats, delivering updates
  • Service Availability: SWG, CASB, ZTNA operational and accessible

Customer Responsibility

Security "in" the Cloud
  • Policy Configuration: Security policies for users, traffic, access
  • Access Control: User identities, authentication, IAM
  • Data Protection: DLP policies to prevent data loss
  • Device Security: Endpoint security for connecting devices
Responsibility by Deployment Model
Customer Manages
Delivered by Skyhigh
A significant risk stems from customers incorrectly assuming the provider secures all aspects of the cloud. Obligations are determined by services selected, integration into existing IT, and relevant legal requirements.

Infrastructure You Can Trust

Frequently Asked Questions

Answers to common questions about Skyhigh Security's privacy, security, and compliance posture.

Data storage location depends on the service and your configuration. For details, see:

→ Configure Data Storage (DLP)
→ Web Access Data for Storage and Reporting
→ Skyhigh Security Cloud Data Retention
Our dedicated Information Security and Privacy teams are responsible for maintaining Skyhigh Security's compliance with a variety of laws, standards, and frameworks. Please visit our certifications page for the complete list.
Skyhigh Security uses AI and Machine Learning extensively across its SSE platform, branded as Skyhigh AI, for two main purposes: securing customer use of AI applications and leveraging AI to improve security operations.

Securing AI Applications: Skyhigh provides visibility into over 1,200 AI apps (including Shadow AI), applies DLP policies to prompts and outputs in tools like ChatGPT and Microsoft Copilot, and enables governance controls such as blocking high-risk AI tools and restricting data sharing.

AI-Enhanced Security Operations: Capabilities include an AI-driven DLP Assistant for generating complex regex without manual coding, ML-based real-time data classification, User and Entity Behavior Analytics (UEBA) for detecting insider threats, ML-powered zero-day threat detection, and Agentic AI detection to identify autonomous AI behaviors within cloud services.

Skyhigh Security does not use customer data to train its underlying models.
Contact PSIRT for Trellix and Skyhigh Security. Submit security vulnerability reports through HackerOne. For other queries, you can reach the team over email at trellixpsirt@trellix.com.
Yes. Log data originating from users' access to Secure Web Gateway can be stored in different geographic locations depending on the region where users accessed the product. Configuring log data residency allows you to comply with regulations that require data originating from a particular region (e.g., Europe) to be stored in that same region.

→ Configure Log Data Residency and Privacy

Have Questions About Security or Compliance?

Our team is available to address your specific trust and compliance inquiries.

اتصل بنا