Information Security Policy (ISMS)
On this page
This Information Security Policy ("Policy") establishes the framework of Tanqory's Information Security Management System ("ISMS"). It is issued by Tanqory Inc. (Delaware, USA) on behalf of itself and its affiliate Tanqory OÜ (Estonia) (together, "Tanqory" or the "Company"). The Policy describes principles, governance, and the control domains that comprise Tanqory's ISMS. Where this Policy references specific operational standards or procedures, those subordinate documents control on the details of implementation.
Status of frameworks referenced in this Policy. Tanqory designs and operates its ISMS in accordance with the principles of ISO/IEC 27001:2022 and uses the control catalogue of ISO/IEC 27002:2022 as a reference framework. Tanqory does not represent that it currently holds ISO/IEC 27001 certification, SOC 2 attestation, or PCI-DSS certification beyond the scope expressly described in Section 18. The authorities listed in this Policy are cited as principles informing Tanqory's design, not as certifications, attestations, or other forms of independent assurance.
1) Purpose
1.1 The purpose of this Policy is to (i) state Tanqory's commitment to protecting the confidentiality, integrity, and availability of information assets it processes; (ii) define the governance and accountability structure for information security across all Tanqory entities; (iii) describe the control domains that comprise the ISMS, by reference to subordinate operational policies; (iv) provide a basis for continual improvement through risk assessment, internal review, and management oversight; and (v) communicate the boundary of what Tanqory currently does, and what is on the ISMS roadmap.
2) Scope
2.1 The ISMS applies to all information assets — data, systems, applications, infrastructure, and supporting processes — that are created, processed, transmitted, or stored in the course of Tanqory's business by Tanqory Inc. and Tanqory OÜ. It applies to all employees, contractors, partners, and third-party providers who access or process such information assets.
2.2 The ISMS covers the Tanqory platform (web applications, dashboards, storefronts, SDKs, mobile and desktop clients, APIs, and backend services), corporate IT and productivity systems, identity and access systems, software-development environments, and the supporting infrastructure operated by Tanqory's cloud and third-party providers.
2.3 The ISMS does not extend to systems operated independently by merchants on third-party infrastructure outside Tanqory's control, except to the extent Tanqory's provision of the Tanqory platform is implicated. Merchant responsibilities are addressed under the Shared Responsibility framework in Section 21.
3) Information security objectives
3.1 The Company's information security objectives are to:
3.1.1 Preserve the confidentiality of information assets, particularly personal data, customer transaction data, intellectual property, and information designated as Confidential or Restricted under the Data Classification Policy;
3.1.2 Maintain the integrity of information processed by Tanqory systems, including by preventing unauthorized modification and by detecting integrity failures when they occur;
3.1.3 Maintain the availability of the Tanqory platform consistent with commitments made in customer contracts and the Service Level Agreement;
3.1.4 Provide a defensible basis for regulatory compliance with applicable laws including the EU General Data Protection Regulation, the UK GDPR, Singapore's Personal Data Protection Act, the California Consumer Privacy Act and California Privacy Rights Act, the EU NIS2 Directive (where applicable), and sectoral rules including the Payment Card Industry Data Security Standard within Tanqory's defined PCI scope;
3.1.5 Provide a structured risk-management process whereby information security risks are identified, assessed, treated, and monitored; and
3.1.6 Support continual improvement through metrics, internal audit, management review, and lessons learned from incidents and exercises.
3.2 Specific, measurable objectives are set annually by the security working group described in Section 4 and reported to management.
4) Governance
4.1 Chief Information Security Officer (CISO). Overall accountability for the ISMS rests with the Chief Information Security Officer (or, pending such appointment, the senior officer designated by management to lead information security). The CISO is responsible for the design, operation, and continual improvement of the ISMS; for approving information security policies; for the risk treatment plan; and for escalating significant information security risks to executive management and the Audit Committee.
4.2 Audit Committee reporting line. The CISO reports periodically to the Audit Committee of the Board (see apps/legal/tanqory_legal/en/governance/audit-committee-charter.md) on the state of the ISMS, significant risks, material incidents, and the status of remediation. The Audit Committee oversees information security risk as part of its enterprise risk-oversight function.
4.3 Security working group. A cross-functional security working group, chaired by the CISO and comprising representatives of engineering, IT, legal, privacy, and product, meets periodically to (i) review risk-treatment progress; (ii) approve subordinate operational policies; (iii) review metrics and incidents; and (iv) advise on the security implications of significant changes.
4.4 Roles and responsibilities. Information owners are accountable for the classification and protection of information within their domain. System owners are accountable for the secure operation of their systems. Engineering managers are accountable for secure design, development, and operations within their teams. All personnel are responsible for complying with this Policy and the subordinate operational policies.
5) Risk management
5.1 Tanqory operates a risk-management process by which information security risks are identified, analyzed, evaluated, and treated. The process applies to changes in the threat landscape, to the introduction or material change of systems and services, and to incidents that reveal previously unidentified risks.
5.2 Risk treatment options include risk mitigation (by application of controls), risk transfer (for example, via insurance or contractual allocation), risk acceptance (with documented justification and an owner), and risk avoidance. Residual risk is recorded and reviewed.
5.3 The risk register is maintained by the security working group and reviewed at each working-group meeting; material risks are escalated to management and the Audit Committee. Detailed methodology is set out in the Risk Management Policy where one exists; pending the formal adoption of that document, this Section governs the risk-management approach.
6) Asset management
6.1 Tanqory maintains an inventory of information assets, including hardware, software, data stores, and information itself. The inventory identifies the owner, the classification (per the Data Classification Policy), and, where appropriate, the criticality and recovery objectives.
6.2 Asset disposal follows the Data Retention Policy and, for media, NIST SP 800-88 or equivalent sanitization methods. See also Section 27 of the Access Control Policy.
7) Access control
7.1 Access to information assets is governed by the Access Control Policy (apps/legal/tanqory_legal/en/trust-and-security/access-control-policy.md), which addresses identity lifecycle, authentication (including multi-factor authentication), authorization (RBAC and ABAC), separation of duties, privileged access management, periodic recertification, and physical access.
7.2 Access control implements the principles of least privilege, need-to-know, zero trust, and accountability.
8) Cryptography
8.1 Cryptographic controls are governed by the Encryption Policy (apps/legal/tanqory_legal/en/trust-and-security/encryption-policy.md), which addresses cryptographic algorithms, key management (generation, storage, rotation, destruction), and the use of customer-managed keys where contracted.
8.2 Personal data and Confidential or Restricted information are encrypted in transit and at rest, using algorithms and key lengths consistent with current industry guidance.
9) Operations security
9.1 Logging and monitoring. Authentication events, authorization changes, privileged actions, configuration changes, and data-access events (where feasible) are logged and forwarded to a centralized log-management system for analysis, detection, and incident investigation. Time synchronization across systems supports correlation and forensic review.
9.2 Malware protection. Endpoint protection software is deployed on managed endpoints. Container and serverless workloads are protected by image scanning, runtime monitoring (where supported), and policy-as-code guardrails.
9.3 Vulnerability management. Vulnerabilities are identified through internal scanning, dependency analysis, and external sources (including the Bug Bounty program), prioritized by risk, and remediated within timelines defined in the operational standards. The Vulnerability Disclosure document (apps/legal/tanqory_legal/en/trust-and-security/vulnerability-disclosure.md) describes external reporting channels.
9.4 Patch management. Patches are evaluated, tested, and deployed on a risk-based schedule. Out-of-cycle patches are applied for high-severity issues.
10) Communications security
10.1 Network segmentation isolates production environments from non-production environments and isolates management planes from data planes. Access to administrative interfaces is restricted to approved networks and trusted devices, consistent with the Access Control Policy and the Network Security Policy (apps/legal/tanqory_legal/en/trust-and-security/network-security-policy.md).
10.2 Information in transit is protected using current transport-layer security protocols. Internal service-to-service communication uses authenticated, encrypted channels where feasible.
11) System acquisition, development and maintenance
11.1 Tanqory operates a secure software-development lifecycle ("SDLC") that integrates security activities into requirements, design, development, testing, deployment, and operations. Activities include threat modeling for significant changes, code review with security considerations, dependency analysis, static and dynamic analysis where appropriate, and pre-deployment review for changes affecting authentication, authorization, or sensitive data flows.
11.2 Changes are managed under the Change Management Policy (apps/legal/tanqory_legal/en/trust-and-security/change-management-policy.md). Production changes require appropriate approvals, are subject to rollback planning, and are logged.
12) Supplier relationships
12.1 Third-party providers that process Tanqory or customer data are subject to the Third-Party Risk Management process (apps/legal/tanqory_legal/en/trust-and-security/third-party-risk-management.md), including due-diligence assessment, contractual safeguards (data-processing agreements, security commitments, audit rights), and periodic re-assessment.
12.2 The Subprocessor List (apps/legal/tanqory_legal/en/data-protection/subprocessor-list.md) is maintained as a source of truth for processors of personal data and is updated when subprocessors are added or removed.
13) Incident management
13.1 Information security incidents are managed under the Incident Response Plan (apps/legal/tanqory_legal/en/trust-and-security/incident-response-plan.md), which addresses detection, triage, containment, eradication, recovery, and post-incident review.
13.2 Personal-data breaches are notified to regulators and data subjects in accordance with applicable law (including GDPR Article 33–34, PDPA, and US state notification statutes), and to customers in accordance with contractual obligations. The Cybersecurity Incident Disclosure Policy and the Bug Bounty Policy (apps/legal/tanqory_legal/en/trust-and-security/bug-bounty-policy.md) govern external disclosure mechanics.
14) Business continuity
14.1 Continuity of critical business services is addressed by the Business Continuity Plan (apps/legal/tanqory_legal/en/trust-and-security/business-continuity-plan.md) and, for IT-system recovery, by the Disaster Recovery Policy (apps/legal/tanqory_legal/en/trust-and-security/disaster-recovery-policy.md) and Backup Policy (apps/legal/tanqory_legal/en/trust-and-security/backup-policy.md).
14.2 Recovery objectives (RTO and RPO) for critical services are documented in the relevant subordinate policies and tested periodically.
15) Compliance: legal and regulatory mapping
15.1 The ISMS supports compliance with applicable laws and regulations, including:
15.1.1 Singapore — Personal Data Protection Act 2012; Cybersecurity Act 2018 (to the extent Tanqory becomes a designated CII owner, which it is not at present).
15.1.2 European Economic Area / United Kingdom — EU GDPR and UK GDPR (in particular Article 32 on security of processing); EU Digital Services Act and EU AI Act, where Tanqory OÜ acts as the EU representative under the relevant articles.
15.1.3 United States — California Consumer Privacy Act and California Privacy Rights Act; sector-specific rules applicable to Tanqory's services; FTC Act §5 (deception/unfairness).
15.1.4 Payment Card Industry — PCI-DSS v4.0 within the scope described in Section 18.
15.2 A mapping of regulatory obligations to subordinate operational policies is maintained by the privacy and security teams and reviewed annually.
16) Statement of Applicability (SoA)
16.1 An ISO/IEC 27001-style Statement of Applicability documents, for each control in the ISO/IEC 27002 control catalogue, whether the control is applicable to Tanqory, the justification for inclusion or exclusion, and the implementation status.
16.2 Tanqory has not yet completed a formal Statement of Applicability. The development of a Statement of Applicability is on the ISMS roadmap. The Company is developing a Statement of Applicability as part of its information-security program maturation; Tanqory is not currently ISO/IEC 27001 certified. Until the Statement of Applicability is formally adopted, this Policy and its subordinate operational policies, together with the operational practices documented therein, describe the implemented control set.
17) Internal audit and management review
17.1 Internal audit of the ISMS is conducted periodically. The scope, frequency, and methodology of internal audit are set by the security working group with oversight by the Audit Committee. Audit findings are tracked to closure.
17.2 Management review of the ISMS is conducted at least annually. The review considers (i) the status of actions from previous reviews; (ii) changes in external and internal issues relevant to the ISMS; (iii) feedback on information-security performance, including incident trends and metrics; (iv) results of risk assessment and the status of the risk-treatment plan; (v) opportunities for continual improvement; and (vi) the need to change the ISMS, including this Policy and subordinate operational policies.
18) Compliance frameworks — scope of operation
18.1 ISO/IEC 27001:2022 / 27002:2022. Tanqory designs the ISMS in accordance with the principles of ISO/IEC 27001 and uses the ISO/IEC 27002 control catalogue as a reference. Tanqory is not currently ISO/IEC 27001 certified.
18.2 SOC 2. Tanqory has not at the date of this Policy obtained an independent SOC 2 attestation report. SOC 2 readiness is on the ISMS roadmap.
18.3 PCI-DSS. Tanqory's PCI scope is limited to that applicable to SAQ-A: Tanqory uses Stripe (or equivalent qualified payment processor — see the Subprocessor List) to handle cardholder data via client-side tokenization. Tanqory does not store cardholder data on Tanqory systems beyond what is permitted within SAQ-A scope.
18.4 NIST CSF 2.0 and NIST SP 800-53. Tanqory uses the NIST Cybersecurity Framework 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover) as an organizing structure for ISMS reporting, and selected NIST SP 800-53 controls (notably AC, AU, IR, SC, SI families) as a reference for specific control activities.
18.5 GDPR Article 32. The security measures described in this Policy and subordinate operational policies are intended to satisfy the Article 32 obligation to implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
19) Continual improvement
19.1 The ISMS is subject to continual improvement. Improvement inputs include metrics, incident lessons learned, internal and external audit findings, customer feedback, regulatory developments, and outputs from management review.
19.2 Improvement actions are tracked with owners and due dates and are reported as part of management review.
20) Cross-references to subordinate operational policies
20.1 This Policy operates as the umbrella document for the Tanqory trust-and-security policy library. The following subordinate policies provide operational detail and are incorporated by reference:
Access Control Policy —
apps/legal/tanqory_legal/en/trust-and-security/access-control-policy.mdEncryption Policy —
apps/legal/tanqory_legal/en/trust-and-security/encryption-policy.mdNetwork Security Policy —
apps/legal/tanqory_legal/en/trust-and-security/network-security-policy.mdChange Management Policy —
apps/legal/tanqory_legal/en/trust-and-security/change-management-policy.mdIncident Response Plan —
apps/legal/tanqory_legal/en/trust-and-security/incident-response-plan.mdBusiness Continuity Plan —
apps/legal/tanqory_legal/en/trust-and-security/business-continuity-plan.mdDisaster Recovery Policy —
apps/legal/tanqory_legal/en/trust-and-security/disaster-recovery-policy.mdBackup Policy —
apps/legal/tanqory_legal/en/trust-and-security/backup-policy.mdVulnerability Disclosure —
apps/legal/tanqory_legal/en/trust-and-security/vulnerability-disclosure.mdBug Bounty Policy —
apps/legal/tanqory_legal/en/trust-and-security/bug-bounty-policy.mdThird-Party Risk Management —
apps/legal/tanqory_legal/en/trust-and-security/third-party-risk-management.mdSecurity Overview —
apps/legal/tanqory_legal/en/trust-and-security/security-overview.mdData Classification Policy —
apps/legal/tanqory_legal/en/data-protection/data-classification-policy.mdData Retention Policy —
apps/legal/tanqory_legal/en/data-protection/data-retention-policy.mdRecords Retention Policy (SOX) —
apps/legal/tanqory_legal/en/governance/records-retention-policy-sox.mdSubprocessor List —
apps/legal/tanqory_legal/en/data-protection/subprocessor-list.md20.2 Where a subordinate policy is more specific than this Policy on a particular topic, the subordinate policy controls on that topic, subject always to the principles set forth in this Policy.
21) Shared responsibility
21.1 Tanqory operates a shared-responsibility model. Tanqory is responsible for the security of the Tanqory platform and the core services it provides. Merchants and other customers are responsible for the configuration and use of the platform within their tenants, including the management of their own users, roles, API keys, and access controls.
21.2 The boundary of responsibility is more fully described in Section 39 of the Access Control Policy and in the applicable Terms of Service and Data Processing Addendum.
22) Adoption, communication, and review
22.1 This Policy is adopted by the CISO with the support of the security working group and is approved at the management level appropriate to its scope. The Policy is published at https://legal.tanqory.com/ and is communicated to all personnel as part of onboarding and periodic awareness training.
22.2 The Policy is reviewed at least annually, and additionally upon material changes in the business, in the threat landscape, in applicable law, or following significant incidents. Versions are tracked with change logs.
22.3 Failure to comply with this Policy or with subordinate operational policies may result in disciplinary action up to and including termination of employment or engagement, and may result in contractual or legal consequences for third parties.
23) Contact
23.1 Questions concerning this Policy or the ISMS should be directed to security@tanqory.com. Inquiries that involve personal data may also be directed to dpo@tanqory.com.