Sécurité

1. Reporting a vulnerability

Write to security@taktoria.com with enough detail to reproduce the problem. We will acknowledge within 7 days, which is the window ISO/IEC 29147 recommends for a first response, and keep you posted while we fix it.

Please give us a reasonable chance to ship a fix before telling anybody else. We will not pursue anyone who reports a genuine finding in good faith, stays within their own workspace's data, and does not degrade the service for other customers.

2. Where it runs

The application is hosted on Cloudflare and the database is PlanetScale, both in the United States. Uploaded pictures are stored in Cloudflare R2. Payments are handled by Stripe, and background jobs are delivered by Inngest.

The Data Processing Addendum lists every sub-processor and what each one does.

3. Encryption

Traffic is encrypted with TLS. Data at rest is encrypted by the providers above. Certificates for workspace hostnames are issued automatically once DNS resolves.

4. Accounts and sign-in

• •Passwords are stored only as hashes, never in a form we could read.
• •Two-factor authentication is available on every account, using a time-based code with single-use backup codes. Repeated failures lock the second factor for a period rather than allowing an unlimited guess.
• •Single sign-on is available, and a workspace can require it by claiming its email domain. A claim only takes effect once a DNS record proves control of that domain, so naming a domain you do not own achieves nothing.
• •Sessions are listed in account settings with the device and address that created them, and any of them can be revoked.

5. Keeping workspaces apart

Every query in the product is scoped to one workspace. A missing scope is treated as a data leak rather than a display bug, and the rule is enforced in review.

Opening an app needs two things: membership of the workspace and a seat on that app's subscription. Both are checked on the server for every request, including the ones behind a form, and never from a workspace identifier supplied by the browser.

6. API keys

An API key is shown once, at creation, and stored as a SHA-256 hash. We keep the first few characters so a key can be recognised in a list, and nothing else. A lost key cannot be recovered, only replaced.

Keys carry scopes, so a key issued for one kind of work cannot be used for another.

7. Incoming webhooks

Requests from Stripe and Slack are verified against their signing secrets before anything is read from them, using the raw request body. An unsigned or missigned request is refused.

8. Uploaded files

Profile pictures and workspace icons are served from a public bucket address. The URL contains a random key and changes whenever the picture changes, but anybody holding it can fetch the file. Treat those fields as public.

9. Backups and deletion

Deleting a workspace removes its data from live systems immediately and from backups within 30 days. Export anything you need first.

10. How changes reach production

• •Every change is reviewed before it merges.
• •Linting, type checking and the full test suite run on every pull request, including tests that exercise workspace scoping against a real database.
• •Database migrations are committed alongside the code that needs them and are never edited once applied.

11. What we do not claim

We hold no third-party security certification at this time, and we would rather say so than imply one. Independent penetration testing is carried out annually.

If your procurement process needs something we have not listed here, ask: security@taktoria.com.