Security is a design requirement in everything TarraCoata builds and operates, for our own website and for the TarraOne platform. This policy summarises the controls we maintain. It is a description of our programme, not a warranty of absolute security.
1. Encryption
- All traffic is served exclusively over HTTPS with TLS 1.2 or higher, modern cipher suites and HSTS.
- Data at rest — databases, object storage and backups — is encrypted with AES-256 or equivalent.
- Secrets, API keys and service credentials are held in a managed secret store, never in source control, and are injected at runtime.
- Passwords, where used, are stored only as salted hashes using a memory-hard algorithm.
2. Authentication
- Sign-in supports federated identity (for example Google) and short-lived access tokens with refresh rotation.
- Multi-factor authentication is required for all administrative and privileged accounts.
- Sessions expire after inactivity and can be revoked centrally.
- Automated defences protect against credential stuffing and brute force, including rate limiting and anomaly detection.
3. Authorisation
- Every database table enforces row-level authorisation, so a request can only reach records that belong to the requesting user or workspace.
- Roles are stored separately from user profiles and evaluated server-side by a security-definer function; role claims are never trusted from the client.
- Privileged operations verify the caller's role on the server before execution.
- Public endpoints are explicitly enumerated, validated and rate limited.
4. Access control
- Least-privilege access, granted by role and reviewed periodically.
- Production access is restricted to named personnel, requires MFA, and is logged.
- Access is revoked immediately on role change or departure.
- Personnel are bound by confidentiality obligations and receive security awareness guidance.
5. Infrastructure security
- Managed, patched cloud infrastructure with environment separation between production, staging and development.
- Edge protection including TLS termination, DDoS mitigation and web application filtering.
- A strict Content Security Policy, secure cookie flags and standard hardening headers on the web tier.
- Server-side validation of all input with schema validation, and output sanitisation to prevent injection and cross-site scripting.
- Automated dependency and configuration scanning, with severity-based remediation targets: critical within 7 days, high within 30 days.
6. Application security practices
- Code review before merge, with security-relevant changes receiving additional scrutiny.
- Automated linting, type checking and tests in the delivery pipeline.
- Database changes applied through reviewed migrations, never ad hoc in production.
- Logging of administrative and security-relevant events, retained for up to 12 months.
7. Data backups and resilience
- Automated encrypted backups with point-in-time recovery and a rolling 35-day retention.
- Restoration procedures are documented and tested periodically.
- Recovery objectives: RPO of up to 24 hours and RTO of up to 24 hours for the platform, unless a signed agreement states otherwise.
8. Incident response
1. Detect — monitoring, alerting and reports from customers or researchers. 2. Triage — classify severity and scope within hours of detection. 3. Contain — isolate affected components, rotate credentials, block malicious traffic. 4. Eradicate and recover — remove the cause, restore from clean state, verify integrity. 5. Notify — affected customers are informed without undue delay and within 48 hours of confirming a personal data breach, with the detail required by the DPA; regulators and data subjects are notified where the law requires. 6. Review — a post-incident review produces corrective actions with owners and deadlines.
9. Vendor management
Sub-processors and vendors are assessed for security posture and data protection before onboarding and are bound by written terms. Categories and purposes are listed in the Data Processing Agreement.
10. Responsible disclosure
We welcome reports from security researchers. Email [security@tarracoata.com] with a description, reproduction steps and impact. Please do not access data that is not yours, degrade the service, or disclose publicly before we have remediated. We acknowledge reports within 3 business days, keep you updated, and will credit you if you wish. We will not pursue legal action against researchers acting in good faith under these guidelines.
11. Your responsibilities
Use strong unique credentials, enable MFA, manage workspace roles carefully, revoke access for departing staff, and avoid uploading data you are not permitted to process.
12. Contact
[security@tarracoata.com] · tarracoatainfo@gmail.com.