Security — Tacit

Foundations

How we protect your data.

Encrypted end to end

Data is encrypted in transit with TLS 1.3 and at rest with AES-256. Consent records are signed so tampering is detectable.

Append-only ledger

Records can be added but never silently altered. Every entry carries a timestamp and policy version, so history stays intact.

Least-privilege access

Internal access is role-based, logged, and reviewed. Almost no one can touch customer data, and every access leaves a trail.

Data residency

Choose EU or US storage on the Scale plan so records stay in the jurisdiction your policies require.

Reliable by design

Redundant infrastructure and automated backups keep the ledger available. Consent shouldn't disappear during an outage.

Isolated environments

Production is separated from development and staging. Customer data never flows into test systems.

Compliance & certifications

We build to recognized standards and are transparent about where we are in the process:

GDPR & CCPA — Tacit is designed to help you meet these, and we hold ourselves to them as a company.
SOC 2 Type II — in progress. We'll publish the report here and share it under NDA with enterprise customers once complete.
Data Processing Agreement — available for all paid customers. We act as your processor; you remain the controller.
Subprocessors — we keep a current list of the infrastructure and service providers we rely on, available on request.

Reporting a vulnerability

Found something? We want to know. Email security@teanakw.com with details and we'll acknowledge within two business days. We don't pursue researchers who act in good faith and give us reasonable time to fix issues.

Questions from your security team?

We're happy to complete security questionnaires and walk through our controls. Reach out and we'll connect you with the right person.

Want the full security details?

Enterprise buyers can request our security package and DPA directly.

Talk to us