Tarosyn Legal

Information Security Policy

Last updated May 31, 2026

Tarosyn is committed to protecting the confidentiality, integrity, and availability of user data and platform systems. This Information Security Policy ("Policy") describes, at a high level, how Tarosyn approaches security governance, risk management, access control, and incident response. It is intended for users, enterprise customers, and partners who wish to understand our security posture. Detailed internal procedures are maintained separately and are not disclosed publicly.

1. security governance

Tarosyn maintains a security programme that is reviewed and updated on an ongoing basis. Responsibility for information security is shared across engineering, operations, and leadership, with a designated owner accountable for the overall programme.

Security policies and standards are reviewed at least annually and after any material change to the platform. Engineering and operational staff receive security-awareness training appropriate to their roles. Third-party vendors and processors are assessed for security posture before being granted access to user data or production systems. Security considerations are incorporated into the software development lifecycle — from design review through deployment and post-release monitoring.

2. risk management

We identify, assess, and treat information security risks as an integral part of operating the platform. Our risk approach includes:

Periodic risk assessments that consider threats to user data, service availability, and platform integrity. Prioritised remediation of identified risks based on likelihood and potential impact. Dependency and supply-chain monitoring — third-party libraries are scanned for known vulnerabilities as part of the CI/CD pipeline. Penetration testing and vulnerability assessments conducted internally and, where appropriate, by independent third parties. A public Bug Bounty programme that invites responsible disclosure of security vulnerabilities from external researchers.

To report a vulnerability, see our Vulnerability Disclosure Policy or the Bug Bounty programme.

3. access controls & data protection

Access to production systems, user data, and administrative capabilities is restricted on the principle of least privilege.

Production database and infrastructure access is limited to authorised engineering personnel. Access is reviewed periodically and revoked promptly when no longer required. All administrative operations that affect user accounts, subscriptions, or content are authenticated via a session-bound credential — bot API keys are explicitly excluded from high-privilege paths. Sensitive data at rest (passwords, tokens, payment references) is never stored in plaintext. Passwords are hashed using an industry-standard adaptive algorithm. Data in transit between clients and the platform is encrypted via TLS. Internal service-to-service calls use encrypted channels. User-uploaded media is stored in isolated object storage with server-enforced access controls and non-executable content-type restrictions. Payments are handled via Stripe and Apple/Google Pay — Tarosyn does not store raw card numbers, CVVs, or full payment-instrument details.

4. employee & workforce practices

Our workforce practices are designed to reduce insider risk and ensure that everyone with access to the platform handles user data responsibly.

All personnel with access to production systems or user data are subject to confidentiality obligations. Access credentials are unique per individual — shared passwords are not permitted for administrative systems. Multi-factor authentication is required for access to administrative consoles and cloud infrastructure. Security training covering phishing, social engineering, and safe data handling is provided to all engineering and operations staff. Access rights are promptly revoked upon role change or departure.

5. availability & resilience

Tarosyn is designed to remain available and recoverable under adverse conditions.

The platform is hosted on cloud infrastructure with redundancy and automatic failover capabilities. Database backups are performed regularly and tested periodically to confirm recoverability. Rate limiting, abuse detection, and resource caps are in place to protect availability against denial-of-service conditions. Monitoring and alerting are configured for abnormal error rates, latency spikes, and security-relevant events.

6. incident detection & response

Tarosyn maintains an incident response process to detect, contain, and recover from security events in a timely manner.

Security-relevant events are logged centrally and reviewed as part of ongoing monitoring. Suspected incidents are assessed for severity and escalated to appropriate personnel without delay. Where an incident results in unauthorised access to personal data, Tarosyn will notify affected users and relevant regulators in accordance with applicable law. Post-incident reviews are conducted to identify root causes and prevent recurrence. Users who discover a potential security incident or vulnerability should contact us immediately at [email protected] or via the Bug Bounty programme — we do not pursue legal action against good-faith researchers. certifications & compliance

Tarosyn does not currently hold a formal third-party certification (e.g. SOC 2 Type II, ISO 27001). We are evaluating formal certification programmes as the platform scales. In the meantime, this Policy and the practices described within it represent our current security commitment.

Enterprise customers or partners who require a completed security questionnaire or additional documentation can request it using the form below, or email us directly at [email protected].

request a security questionnaire

Evaluating Tarosyn for your organisation? Tell us a little about your intended use and which compliance frameworks you work with, and our security team will route a completed questionnaire and any supporting documentation to you.

Company name Work email Intended use Frameworks required (optional)

SOC 2

ISO 27001

GDPR

HIPAA

PCI-DSS

NIST

CSA STAR / CAIQ

Other Additional details (optional) Request security questionnaire changes to this policy

This Policy will be reviewed and updated periodically to reflect changes in our practices or applicable law. Material updates will be communicated via in-app notification or email.

See our Security & Bug Bounty overview

Security enquiries? [email protected]