Legal
Information Security Statement
This Statement summarises, for Customers, partners and their security teams, the technical and organisational measures Infotech Solutions applies to protect information in the Tamanor service. It complements the more detailed Security Policy and supports Article 32 GDPR and Annex 2 of our DPA.
Last updated: 17 July 2026
1. Governance
Security principles are treated as product invariants that cannot regress. We follow a data-minimisation, least-privilege, and fail-safe philosophy, and review our controls at least annually and after material changes or incidents.
2. Data protection
- Encryption in transit: TLS for all client-server and server-service communication.
- Encryption at rest: OAuth tokens are encrypted at rest in production (AES-GCM or KMS/envelope); plaintext token storage is rejected in production. Passwords are stored only as salted hashes.
- Minimisation: we store only what is needed to operate the Service; no scraping and no platform passwords.
3. Access control & tenant isolation
- Multi-tenant isolation: every record is tenant-scoped; cross-tenant access is prevented in the application and enforced in the database via PostgreSQL row-level security with a non-superuser runtime role.
- Role-based access control: owner/admin/moderator/viewer, enforced server-side.
- Least privilege and prompt de-provisioning for staff.
4. Application & integration security
- Official APIs / OAuth only, with minimum scopes; tokens never exposed to the client or logs.
- Signed webhooks (HMAC-SHA256) with a validity flag; webhook events take no automatic action.
- CSRF-protected OAuth flows via httpOnly state cookies.
- Fail-closed configuration: live actions and new connectors are disabled by default; kill switches can halt all live actions instantly.
5. Auditability
An append-only, immutable audit log records every automated and human action (who/what/when/why, engine version, confidence). No executed action can exist without an audit entry.
6. Reliability & continuity
Regular backups; token refresh, rate-limiting and retries are designed to fail safe; recovery and continuity are covered by operational runbooks and disaster-recovery procedures.
7. Secure development
Small, reviewable changes with type-checking and build verification; no impersonating demo data; no real platform calls until a connector is authorised; secrets held only in server-side configuration.
8. Sub-processors
Infrastructure providers are contracted with equivalent obligations and listed in the Subprocessor List.
9. Incident response
We maintain an Incident & Breach Policy aligned with GDPR Articles 33–34, including containment, assessment, notification and post-incident review.
10. Certifications & assurance
We are an early-stage provider and align our controls with recognised good practice and the GDPR. Where formal certifications (e.g. ISO/IEC 27001) or third-party reports are obtained, they will be referenced here and available on request. Contact info@tamanor.com for current assurance materials.