Trust center
How we protect the stores on Tanqory and the people who buy from them: the controls that run today, the ones still ahead, and every policy behind them, readable without a form.
Updated
Our approach
Tanqory runs on DigitalOcean behind the Cloudflare edge, with Google Cloud and AWS for secondary compute and storage. Four business regions are provisioned and each billing country has a home region; production runs in one region today.
Card numbers never reach our servers: buyers type them into our payment providers' fields and we keep only their tokens. Passwords are stored as Argon2 hashes, and secrets such as OAuth tokens and payment credentials are encrypted with AES-256-GCM before they are saved.
Tanqory is not certified against SOC 2 or ISO/IEC 27001 yet. We are working toward both, and this page says plainly which controls are in place and which are not.
Compliance
Where we stand on each framework today, in words, not badges.
- PCI DSSCard payments. Scope SAQ-A: cards are entered in our payment providers' fields and never reach us.Self-assessment in progress
- SOC 2 Type 1Design of security controls at a point in time.Not started. Planned for FY2026 H2
- SOC 2 Type 2Security controls operating over twelve months.Not started. Planned for FY2027
- ISO/IEC 27001Information security management system.Not certified. Planned for FY2027
- ISO/IEC 27701Privacy management, built on ISO/IEC 27001.Not certified. Follows ISO/IEC 27001
- ISO/IEC 42001AI management system.Not certified. Planned for FY2027
What protects a request
One order, from the buyer to the stored data, and the controls on each hop.
- Browser or appThe buyer's device
- TLS 1.2 or higher on every connection
- Card details typed into the payment provider's fields
- Cloudflare edgeGlobal network
- Every public DNS record proxied
- WAF and API Shield
- DDoS mitigation
- IngressLoad balancer and ingress-nginx
- Rate limits in the API gateway and store API
- Uploads scanned for malware
- Platform servicesKubernetes
- JWT sign-in with role-based access
- Admin changes written to an audit log
- Data storesManaged PostgreSQL and Valkey
- AES-256 encryption at rest on PostgreSQL
- Tokens and credentials encrypted again with AES-256-GCM
- Daily backups kept 7 days
Controls
What runs on the platform today, area by area.
Infrastructure
DigitalOcean first, two more clouds, one edge network.
- Production on DigitalOcean, with Google Cloud and AWS for secondary compute
- Managed PostgreSQL in a high-availability pair with a read replica
- Secrets delivered from a self-hosted secrets manager
Network security
Every request meets Cloudflare first.
- Every public DNS record proxied through Cloudflare
- Cloudflare WAF and API Shield on API traffic
- Automatic DDoS mitigation
Data and encryption
Encrypted on the wire and at rest.
- TLS 1.2 or higher in transit
- AES-256 at rest on managed databases
- Tokens and credentials encrypted again with AES-256-GCM
Access control
Who can do what, and a record of it.
- JWT authentication with role-based access in the admin
- Authenticator-app codes for two-step sign-in
- Admin changes recorded with actor, object and time
Monitoring
Errors, metrics and logs in one place.
- Errors and performance tracked in Sentry
- Metrics in Prometheus and Grafana
- Logs collected centrally
Backups and recovery
Daily backups and written recovery targets.
- Daily managed database backups kept 7 days
- Recovery objectives of one hour (RTO and RPO)
- A written disaster recovery runbook
Privacy
Merchants decide; we process for them.
- Merchants control their buyers' data
- Data classified from P0 (restricted) to P4 (public)
- Marketing only with opt-in consent
AI
Third-party models, named and limited.
- Tanqory trains no models on your data
- Training switched off with OpenAI and Anthropic
- Every AI provider named, with where it processes data
Policies and documents
The policies behind this page, each open to read.
- Security OverviewA summary of Tanqory's security program, from governance and architecture to incident response and privacy.Updated
- Information Security Policy (ISMS)The framework for Tanqory's information security management system and the controls that protect its information.Updated
- Encryption PolicyThe encryption principles and standards Tanqory uses to protect data at rest and in transit.Updated
- Access Control PolicyHow Tanqory controls who can access its systems, applications, data and facilities.Updated
- Incident Response PlanHow Tanqory detects, contains, recovers from and notifies about security incidents such as data breaches.Updated
- Data Processing Agreement (DPA)The agreement setting how Tanqory processes personal data on a merchant's behalf as the merchant's data processor.Updated
Subprocessors
35 companies on our public list process personal data for us. The first ones:
| Subprocessor | What it does for us | Where |
|---|---|---|
| DigitalOcean, LLCHosting | Primary cloud hosting | Singapore |
| Cloudflare, Inc.Hosting | DNS, CDN, firewall, DDoS protection, R2 object storage, Workers, API Shield and Turnstile bot checks | Global edge network |
| MongoDB, Inc.Hosting | Vector search and document storage for AI features | Singapore, on AWS |
| Amazon Web Services, Inc.Hosting | Theme asset storage on Amazon S3 | Singapore |
| Stripe, Inc.Payments | Billing for Tanqory plans, and merchant payments through Stripe Connect | Worldwide |
| PayPal Holdings, Inc.Payments | PayPal as a way to pay for Tanqory plans, and merchant payments through PayPal | Worldwide |
| Braintree, a service of PayPal, Inc.Payments | Merchant payments | Worldwide |
| OpenAI, L.L.C.AI | Language models, embeddings and image generation | United States |
Data regions
Four business regions are provisioned. Production runs in one region today, with no failover to a second one yet.
- Asia PacificSingapore, Malaysia, Indonesia, Philippines, Vietnam, Japan, South Korea, India, Australia, New Zealand
- AmericasUnited States, Canada, Mexico, Brazil, Argentina, Chile, Colombia
- EuropeEuropean Union/EEA member states, United Kingdom, Switzerland
- Middle East and AfricaUAE, Saudi Arabia, Qatar, South Africa, Egypt, Nigeria, Kenya
Latest updates
Questions
Does Tanqory hold SOC 2 or ISO 27001 certification?
Not yet. No SOC 2 or ISO/IEC 27001 audit has started. SOC 2 Type 1 is planned for FY2026 H2, then SOC 2 Type 2 and ISO/IEC 27001 in FY2027. Until an audit is passed, we describe our controls as designed in accordance with these frameworks, never as certified.
How does Tanqory handle PCI DSS?
Card numbers never reach Tanqory's servers. Buyers type them into our payment providers' fields and we keep only tokens, which places us in the smallest PCI DSS scope, SAQ-A. Our SAQ-A self-assessment is in progress. Stripe, which processes the payments, is a PCI DSS Level 1 service provider.
Where is my store data kept?
Four business regions are provisioned on DigitalOcean, Google Cloud and AWS: Asia Pacific, the Americas, Europe, and the Middle East and Africa. A merchant is assigned the region nearest their billing country at signup. Production runs in one region today, and failover between regions is not in place yet.
Do you train AI models on my store data?
No. Tanqory trains no models of its own. AI features call third-party models, and with OpenAI and Anthropic training on what we send is switched off. Every AI provider, and where it processes data, is on the AI governance page.
Has Tanqory had a penetration test?
Not yet. The first independent penetration test comes before the SOC 2 Type 1 audit. Until then we take reports from researchers through our vulnerability disclosure program.
How do I report a security issue?
Email security@tanqory.com with the steps to reproduce. We acknowledge reports within 24 business hours. The vulnerability disclosure policy sets out the scope and our safe harbor.
Found a security issue?
Write to security@tanqory.com with the steps to reproduce it. We acknowledge every report within 24 business hours, keep you posted while we fix it, and never take legal action against research done in good faith under our disclosure policy.