Product · compliance & security
Pass procurement before the second meeting.
Air cargo handling lives inside customs, security, and audit regimes that change every quarter. Skidd ships e-CSD, station-scoped RBAC, and replayable audit built in, with SAML/OIDC SSO and a multi-tenant console available on Pro.
Capability detail
e-CSD — electronic Customs Security Declaration
Capture the Regulated Agent designator per station, sign the security declaration at acceptance, and Skidd auto-emits the OCI fields on every outbound FWB for EU departures. The compliance dashboard tells your station manager which stations are configured and which are still missing an RA — before an audit does.
8-role, station-scoped RBAC
Admin, station manager, customer service, warehouse op, dock supervisor, screening, DG officer, and readonly — each scoped to specific stations or all of them. A warehouse op at NCE can't see CDG freight, a dock supervisor can't edit rate cards, and the admin's actions are audited too.
Row-level security at the database
Station scope is enforced as a Postgres RLS policy, not an application-level filter. Even a buggy admin endpoint can't cross-leak data between stations — the database refuses the read. The same protection holds for cross-tenant boundaries on the multi-tenant platform.
Append-only audit log with retention
Every write — status transitions, rate-card edits, member invites, e-CSD signatures, ONE Record subscriptions — is appended to a tenant audit log with operator, timestamp, and structured payload. Queryable from the platform console; exportable for SOC 2 or carrier audits.
SAML/OIDC SSO (early access, platform-configured)
Connect your identity provider via SAML or OIDC and Skidd delegates auth, role provisioning, and session lifecycle. Configured by the Skidd team during onboarding — available on Pro in early access. No separate password store, no shared logins, no offboarded employee with lingering access.
Multi-tenant console (Pro)
Holdings and group handlers run multiple operating tenants from one platform console — airline registry, airport registry, and audit log all live at the platform layer. Available on Pro. Spin up a new station for a new joint venture without re-onboarding your IT team.
Audit log shape
{
"ts": "2026-04-25T08:34:12Z",
"tenant": "handler-nce",
"actor": {
"user_id": "u_8s3...",
"email": "mberg@example.com",
"role": "station_manager"
},
"station": "NCE",
"action": "shipment.transition",
"resource": "awb:180-12345678",
"payload": {
"from": "BKD",
"to": "MAN",
"flight": "LH1234/25APR"
},
"request_id": "req_01HXYZ...",
"ip": "203.0.113.7"
}Procurement-ready answers
- Where does data live?
- EU region by default, on Vercel-hosted compute backed by managed Postgres. Per-tenant region pinning available on Pro for handlers under data-residency constraints.
- How do you handle PII?
- Cargo workflows touch shipper / consignee / agent contact data. Encrypted at rest and in transit; access logged via the audit trail; deletable per-tenant on contract end.
- What about EU GDPR & the air-cargo PNR-style obligations?
- Skidd is the data processor for cargo records the handler controls. We sign DPAs and SCCs, run regional residency, and can document subprocessors on request.
- Can your audit log answer “who moved this AWB to MAN?”
- Yes — to the second, with operator, IP, and request id. That's the question billing disputes and customs audits actually ask.