Security Overview

This overview summarizes Tanqory’s security program: governance, security architecture, data protection, secure SDLC, network/infrastructure, monitoring and incident response, business continuity, third-party management, privacy, testing/certifications, SLAs, and key contacts. It highlights our principles, controls, and baselines used to align with international standards and large-scale platform expectations. The English version controls; if any translation conflicts arise, the stricter law or more specific/latest document prevails.

1) Governance & Principles

• We operate an ISO/IEC 27001-aligned ISMS and SOC 2-aligned control framework, overseen by a risk/security committee that approves policies, exceptions, and monitors KRIs.
• Core principles: Layered Security; Least Privilege; Zero Trust; Security by Design; Privacy by Design/Default; Continuous Monitoring; Assume Breach.
• Policies/standards are reviewed at least annually or upon major threat/legal changes. Exceptions require written approval with rationale and sunset, and are logged.
• The English version is binding; stricter contractual terms for enterprise customers are set in Order Forms/appendices.

2) Security Architecture & Zero Trust

• Zero Trust across identity (MFA/SSO/RBAC), device (posture via EDR/MDM), network (segmentation/micro-segmentation), application (policy-based access), data (encryption/access limits/logging), and operations (assume breach, continuous monitoring).
• Internal service traffic uses TLS 1.2+ (prefer 1.3) and mTLS for sensitive flows; all customer-facing endpoints are HTTPS with HSTS.
• Perimeter controls: WAF, DDoS protection, bot management sized to production risk.
• Critical services require MFA and RBAC with audit logging; client mutual auth and service identity validation are used where feasible to reduce attack surface.
• IP/CIDR plans avoid overlap; network zones separate Public/DMZ, Application, Data, Management, and Non-Production.

Zero Trust snapshot (illustrative)

3) Data Protection & Privacy by Design

• Encrypt in transit (TLS) and at rest (AES-256). Use KMS/HSM with role separation for key management; rotate keys per risk (e.g., 90–180 days for services, shorter for high-privilege keys).
• Data Classification defines required controls (encryption, DLP, access restrictions). Data minimization, purpose limitation, and retention schedules apply to all systems.
• DPIA (Data Protection Impact Assessment) for sensitive processing or cross-border transfers; apply SCC/IDTA/DPF or equivalent safeguards as required.
• Privacy by Design/Default in SDLC; user rights processes for access/rectification/deletion/portability/opt-out are documented in our Data Rights/Privacy Policy.
• Administrative, logical, and technical controls align with GDPR/PDPA and other applicable privacy laws; client-side encryption is available where required.

4) Application Security & Secure SDLC

• Secure SDLC includes threat modeling, SAST, DAST, SCA, and security code review for key releases; OWASP Top 10 and OWASP API Top 10 are minimum test baselines.
• Secrets (API keys, tokens) are managed in approved secret stores; no secrets in code/CI.
• PRs require code review and automated tests (unit/integration/security scans) before deploy.
• Least privilege for service accounts; enforced rotation; code signing for distributed client/SDK binaries.
• SBOMs are maintained for major services; supply-chain checks include dependency pinning and vulnerability gating.

5) Network & Infrastructure Security

• Hosted on cloud providers that maintain their own ISO 27001 / SOC 2 / PCI-DSS attestations (DigitalOcean, Amazon Web Services, Google Cloud, Cloudflare, MongoDB Atlas). Tanqory inherits the infrastructure controls of these providers; Tanqory's own ISMS is not yet certified — see the trust center for our certification roadmap. Region selection follows the multi-region map in Section 5.1 below to honor data residency.
• Segmented networks (Prod/Non-Prod/Admin) with Firewall/ACL/Security Groups; VPN/Private Link/Zero Trust for internal access; IDS/IPS and behavior analytics for anomaly detection.
• Centralized logging to SIEM with 24/7 alerting; certificate pinning where supported; latest TLS enforced.
• Management plane access uses MFA, JIT elevation, and device posture; bastions isolated in management zones.

6) Vulnerability Management & Testing

• Regular vulnerability scanning; penetration testing at least annually and after major changes.
• Bug Bounty/VDP intake for external reports.
• CVSS v3.1-based severity with SLOs: Critical/High — immediate plan/rapid remediation; Medium/Low — per standard cadence.
• Patch management for OS/platform/libraries and network gear (firewalls/WAF/IDS/IPS/VPN); end-of-support assets scheduled for replacement.

7) Logging, Monitoring & Incident Response

• Log critical events (authn/authz, config changes, data access, admin actions) to centralized, access-controlled, encrypted stores.
• SIEM with 24/7 alerting; linked runbooks for major scenarios (data breach, ransomware, account takeover).
• Incident Response Plan follows Identify → Contain → Eradicate → Recover → PIR; customer/partner notifications per contract/law (e.g., 24–72h depending on severity).
• Metrics tracked (MTTD/MTTR/MTTC, SLA adherence, recurrence); lessons learned feed control updates.

8) Business Continuity & Disaster Recovery

• BCP and DR tested regularly; RPO/RTO defined by system tier.
• Encrypted backups with tested restores; multi-AZ/Region architectures for critical services per contract/regulation.
• P1 communication cadence: updates every 60–120 minutes or faster as contractually required.
• Enterprise-binding SLAs for Incident/BCP/DR are in Order Forms/appendices; this overview is the baseline unless stricter numbers are contracted.

9) Third Parties & Supply Chain

• Third-Party Risk Management (TPRM) covers due diligence, risk tiering, contracts (DPA/SCC/IDTA, audit rights, breach notice, BCP/DR), continuous monitoring, and offboarding.
• Suppliers must meet security/privacy controls per tier and report material incidents within defined SLAs.
• Sub-processor list is maintained and updated at legal.tanqory.com; changes follow notice/consent requirements where applicable.

10) Training, Testing & Certifications

• Annual security/privacy training for all staff; phishing simulations; secure coding training for engineers.
• Tabletop/simulation for IR and BCP/DR per schedule.
• Certification status (transparent): Tanqory is not currently certified against ISO/IEC 27001, ISO/IEC 27701, SOC 2 Type II, or PCI-DSS. We operate an Information Security Management System (ISMS) designed in accordance with these frameworks and self-assess against them. Our published roadmap targets SOC 2 Type 1 in FY2026 H2, SOC 2 Type 2 in FY2027, and ISO 27001 in FY2027. PCI-DSS scope is limited to SAQ-A because no cardholder data is stored, processed, or transmitted by Tanqory infrastructure (Stripe.js client-side tokenization).
• Self-assessment reports and the ISMS scope statement are available under NDA via security@tanqory.com. Third-party attestations will be published at https://trust.tanqory.com once issued.

11) Customer Commitments, SLAs, and Communication

• Default baselines: HTTPS-only endpoints; TLS 1.2+/prefer 1.3; P1 incident engagement ≤15 minutes, initial containment ≤1 hour; customer updates every 60–120 minutes for P1 until stabilized.
• Uptime/BCP/DR/notification SLAs that differ for enterprise customers are binding only if stated in Order Forms/contract schedules.
• Status updates during critical events via https://status.tanqory.com and designated contact channels; escalation contacts are provided in contracts.

12) Compliance Mapping (High-Level)

• ISO/IEC 27001/27002 (ISMS), ISO/IEC 27701 (privacy), SOC 2 (security/availability/confidentiality/privacy), PCI DSS (where in scope), GDPR/PDPA/other privacy laws, NIST CSF/800-53 (select controls), NIST 800-61 (IR), NIST 800-63 (identity), OWASP ASVS/API ASVS, CIS Benchmarks (where applicable). Detailed mappings are available in control matrices and upon request under NDA.

---

Appendix A: Key Controls Summary

• Encryption: TLS enforced everywhere; AES-256 at rest; KMS/HSM with role separation.
• Access: MFA required for critical systems; SSO/RBAC; least privilege; centralized IAM; JIT elevation.
• Network: Segmentation/Firewall/ACLs; WAF/DDoS/bot mitigation; VPN/Private Link/ZTNA for internal/partner access.
• Application: Secure SDLC; SAST/DAST/SCA; code review; secret management; OWASP Top 10/API Top 10 testing; code signing for distributed binaries.
• Logging & Monitoring: SIEM with 24/7 alerting; audit logging for critical events; behavior analytics.
• Vulnerabilities: Routine scanning; annual (or more frequent) pen tests; Bug Bounty/VDP; CVSS-based remediation SLOs.
• Incident/BCP/DR: IRP with runbooks; tested BCP/DR; RPO/RTO by tier; P1 comms every 60–120 minutes.
• Third parties: TPRM with tiering, due diligence, DPA/SCC/IDTA, audit rights, incident notice, offboarding.
• Training: Annual security/privacy; phishing simulations; secure coding for engineering.

Appendix B: Regional/Residency & Crypto Profiles

Tanqory Business Region Map (live)

Tanqory operates pods across four business regions on three cloud providers (DigitalOcean, Google Cloud, AWS), fronted globally by Cloudflare. The live region map is published at https://trust.tanqory.com/regions.

• Residency (align per contract/Order Form):

  • ASIA_PACIFIC: Primary Singapore, DR within APAC; no failover outside APAC without written consent.
  • AMERICAS: Primary US-East, DR US-Central or US-West; US/Canada-only unless otherwise agreed.
  • EUROPE: Primary Frankfurt, DR Amsterdam/Ireland; no failover outside EU/UK if contractually restricted.
  • MIDDLE_EAST_AFRICA: Primary Doha/Bahrain, DR Cape Town or APAC fallback by written agreement.

• Crypto profiles:

  • Public endpoints: TLS 1.2+ (prefer 1.3), HSTS, modern AEAD ciphers (AES-GCM/ChaCha20), OCSP stapling.
  • Service-to-service (sensitive/PCI/PHI): enforce TLS 1.3 where supported; otherwise TLS 1.2 with AEAD only; mTLS mandatory; PFS required.
  • Admin/SSH: SSH v2, strong ciphers (no CBC/MD5/SHA-1); MFA + device posture.

Glossary

• AES, ACL, BCP/DR, CVSS, DAST, DLP, DPA, GPC, IAM, IDTA, IRP, KMS, MFA, PCI DSS, RBAC, RPO/RTO, SAST, SCA, SCCs, SIEM, SOC 2, TPRM, WAF, VDP (see definitions in related policies; common industry meanings apply).