Tarseek Legal Center

Security & Trust

This page describes Tarseek’s intended security and trust posture. It does not claim certifications Tarseek has not achieved. Do not read empty sections as completed controls.

1. Hosting

Production hosting is planned on Google Cloud. The production region has not been selected, so this page does not name one. Local development defaults are not the production environment.

2. Encryption

Tarseek uses technical safeguards to protect sensitive credentials and secrets. Provider API keys and other sensitive credentials may be encrypted before storage, and Tarseek API key secrets are not stored in recoverable form after creation. Tarseek does not currently claim that all encryption keys are managed through a dedicated cloud key-management service. Additional production key-management controls may be introduced as the Service infrastructure evolves.

Transport security

Tarseek is intended to be served over secure encrypted connections in production. Tarseek does not currently make a contractual guarantee regarding a specific transport-security implementation until the production infrastructure is deployed and verified.

3. API keys and secrets

Users can restrict, rotate, disable, and revoke Tarseek API keys. Saved provider credentials are not shown again after they are saved.

4. Authentication and access control

Accounts use email and password, email verification, password reset, and sessions that last up to 30 days or until logout or revocation. Google, GitHub, and Microsoft sign-in are optional. Multi-factor authentication is not offered.

5. Network security

Network controls are part of the production host configuration and are not described here.

6. Logs, retention, and data isolation

Security logs may be retained as needed. Customer API content should not appear in long-lived logs by default. Customer data should be logically isolated by account. See Data Practices.

7. Backups

Where backups are maintained, deleted data may remain in backup copies for up to 30 days. Backup copies are not active user storage. If no backup exists when data is deleted, that extra retention does not apply. See Data Practices.

8. Abuse prevention

Rate limits, fraud review, AUP enforcement, and key suspension. See the Acceptable Use Policy.

9. Incident response

[TBD: incident response plan, severity levels, customer notification process.] Personal-data incidents affecting processor-role data are also addressed in the DPA.

10. Vulnerability management

Dependency updates, patching, and intake via the Vulnerability Disclosure Policy. No public bug bounty is promised unless Tarseek launches one.

11. Compliance claims

The following are not claimed unless independently achieved and then stated with a date and scope:

• SOC 2
• ISO 27001
• HIPAA
• PCI DSS (card data should be handled by a processor; that is not the same as Tarseek being PCI certified)

Placeholders exist so these programs can be tracked as the company matures.