Technology and infrastructure
The systems Tanqory runs on, how a request crosses them, how code reaches production, and how we recover when something fails.
Updated
- Clouds: DigitalOcean, Google Cloud, AWS
- 3
- Recovery objectives, RTO and RPO
- 1 h
- Daily backups kept
- 7 days
- Browser or appThe buyer's device
- Cloudflare edgeGlobal network
- IngressLoad balancer and ingress-nginx
- Platform servicesKubernetes
- Data storesManaged PostgreSQL and Valkey
One request, end to end
A buyer's checkout request, from the browser to the stored order.
- Browser or appThe buyer's device
- TLS 1.2 or higher on every connection
- Card details typed into the payment provider's fields
- Cloudflare edgeGlobal network
- Every public DNS record proxied
- WAF and API Shield
- DDoS mitigation
- IngressLoad balancer and ingress-nginx
- Rate limits in the API gateway and store API
- Uploads scanned for malware
- Platform servicesKubernetes
- JWT sign-in with role-based access
- Admin changes written to an audit log
- Data storesManaged PostgreSQL and Valkey
- AES-256 encryption at rest on PostgreSQL
- Tokens and credentials encrypted again with AES-256-GCM
- Daily backups kept 7 days
Hosting
- DigitalOceanPrimary compute and data: Kubernetes, Managed PostgreSQL, Managed Valkey, object storage and the container registry.
- Google CloudSecondary compute, with per-region clusters where they are needed.
- AWSSecondary compute and storage, including theme assets, and PostgreSQL where a contract requires AWS.
- CloudflareDNS, CDN, WAF, DDoS protection, R2 object storage and Workers at the edge.
Data stores
- PostgreSQLStore, policy, theme, tax and analytics data, on managed PostgreSQL in a high-availability pair with a read replica, encrypted with AES-256.
- ValkeyCache, sessions and job queues, in a high-availability pair.
- MongoDB AtlasVector search for AI features, in AWS Singapore, with encrypted storage.
- Object storageCloudflare R2 serves cdn.tanqory.com; theme assets are moving there from AWS S3.
How code ships
- BuildChanges are built on Buildkite.
- DeployArgoCD rolls out what the deploy repository declares.
- SecretsA self-hosted secrets manager delivers keys to the cluster at run time.
- WatchSentry, Prometheus and Grafana show errors and load after each release.
Backups and recovery
Targets we hold ourselves to, and the gaps we have not closed.
- BackupsThe database provider takes a backup every day and keeps each one for 7 days.
- ObjectivesRecover within one hour (RTO), lose at most one hour of data (RPO).
- RunbookA written disaster recovery runbook; drills are scheduled.
- Not yetNo offsite backup copy and no automatic failover between regions.
Policies and documents
- Security OverviewA summary of Tanqory's security program, from governance and architecture to incident response and privacy.Updated
- Backup PolicyRequirements for backing up and restoring Tanqory systems and data to protect availability and integrity.Updated
- Disaster Recovery PolicyHow Tanqory restores services and data after major disruptions to limit downtime and data loss.Updated
- Business Continuity Plan (BCP)How Tanqory keeps critical services running and recovers when unexpected disruptions occur.Updated
- Change Management PolicyThe approval, testing and rollback controls Tanqory applies to changes in its systems and processes.Updated
Questions
What uptime do you commit to?
We publish no uptime figure. Live status and incident history are at status.tanqory.com.
Still have a question?
For anything this page does not answer, write to security@tanqory.com.
More in the trust center
Found a security issue?
Write to security@tanqory.com with the steps to reproduce it. We acknowledge every report within 24 business hours, keep you posted while we fix it, and never take legal action against research done in good faith under our disclosure policy.