Security

Encryption

All data is encrypted both in transit and at rest:

• • In Transit: TLS 1.3 for all API communications
• • At Rest: AES-256 encryption for all stored data
• • Keys: Managed through AWS KMS with automatic rotation

Infrastructure Security

We run on enterprise-grade infrastructure:

• • Hosted on AWS with SOC 2 Type II compliance
• • Multi-region redundancy for high availability
• • Automated backups every 6 hours
• • DDoS protection and rate limiting
• • Regular security audits and penetration testing

Access Control

We implement strict access controls:

• • API key authentication for all requests
• • Role-based access control (RBAC)
• • Multi-factor authentication for team accounts
• • Audit logs for all data access
• • Principle of least privilege for internal access

Compliance

We maintain compliance with industry standards:

• • GDPR compliant data handling
• • SOC 2 Type II certified
• • HIPAA compliance available for Enterprise
• • Regular third-party security audits

Monitoring & Response

We actively monitor for security threats:

• • 24/7 security monitoring and alerting
• • Automated threat detection
• • Incident response team on standby
• • Regular security training for all employees

Data Isolation

Each customer's data is logically isolated. We use database-level isolation and encryption to ensure your data is never accessible to other customers. Enterprise customers can opt for dedicated infrastructure.

Vulnerability Disclosure

If you discover a security vulnerability, please report it to us:

• • Email: security@tannur.xyz
• • We respond to all reports within 24 hours
• • We offer a bug bounty program for valid findings

Certifications & Audits

Our security posture is verified by third parties:

• • SOC 2 Type II audit completed annually
• • Penetration testing performed quarterly
• • Security reports available upon request