Trust center
Security you can check
Real-time call buying moves caller data, customer data and money in seconds. Here is how TapQuality keeps access narrow, keeps each customer’s data apart and recovers when something fails, with the status of every control, including what is planned.
Next review 2 February 2027
Control status
2 November 2026
23 controls tracked, in public
- In place
- 20
- Planned
- 3
- Customer data separated by organization
- Data services off the public internet
- A person approves every change
Overview
How we protect the platform
Several layers, so no single control has to hold on its own.
Narrow access
A signed identity on every request. People get roles, machines get scoped keys, and administration runs on a private network.
Customers kept apart
Data is separated by organization in the application, caches and analytics, and tests check the boundary.
Protected data
TLS on public traffic. Credentials encrypted, API keys stored one-way, provider messages signature-checked.
Controlled changes
Automated build, test, dependency and security checks, then a person reviews. Rollouts are versioned and reversible.
Watched in production
Checks cover the application, hosts, event flow and backups. Security-relevant actions are recorded.
Recoverable
The primary database archives every change and can be restored to a point in time. Data services stay off the internet.
Advanced agentic security
Agents hunt for weaknesses. People approve every fix.
Powered by OpenAI Daybreak frontier cybersecurity. Agents running Daybreak and Codex Security map our code and services, look for weaknesses, prove which ones are real, and draft narrow fixes. Nothing merges or ships until a person approves it, and every fix is checked again after release.
Sweep the surface
Illustrative- Flagged
- Proven real, goes to a fix
- Not reachable, closed
From finding to verified fix
Every change- 01
Inventory
Map the code and services that face the internet.
- 02
Discover
Agents look for possible weaknesses.
- 03
Validate
Prove a finding is real and reachable. Most are not.
- 04
Patch
Draft the narrowest fix that closes it.
- 05
Test
Run the full test suite and security gates.
Human reviewhuman gate
A person approves before anything merges or ships.
- 07
Verify
Check the fix again after release.
In practice
When a serious Linux networking flaw was disclosed, the loop assessed whether it reached our platform, closed the exposed path with a narrow control, updated the affected dependencies, and tightened the security gate so it fails closed when scan data is missing. Every step went through the normal review and release path.
Control status
Where each control stands
Reviewed every quarter and after any material change. In place means it runs today, with evidence. Planned means it is scheduled and not yet running.
Access
- User sign-inIn place
Every request carries a signed identity. Production refuses to start with unsafe sign-in settings.
- RolesIn place
Defined platform and organization roles, checked on each route.
- API keysIn place
Random keys, stored one-way, scoped to what they may do, and rate limited. Keys can be set to expire.
- Administrator accessIn place
A private, identity-aware network. No public password or root login.
- Access reviewsPlanned
Quarterly reviews of who holds privileged access, with records kept.
Data
- Customer separationIn place
Data is separated by organization in the application, caches and analytics. Tests check the boundary.
- Network exposureIn place
A narrow public surface. Data services are not reachable from the internet.
- Encryption in transitIn place
All public traffic uses TLS. Services talk to each other over a private network, never the public internet.
- Encryption at restIn place
Integration credentials are encrypted and API keys are stored one-way, at the application layer.
- Data minimizationIn place
Sensitive identifiers are hashed in high-volume data paths. Seeing a full phone number takes a specific permission.
- Retention and deletionIn place
Logs and high-volume event stores expire data on a set schedule.
- Audit recordsIn place
Security-relevant actions by people and systems are recorded with who did them.
Building and shipping
- Code review and CIIn place
Tests, type and race checks, migration checks and a protected merge path. A person reviews each material change.
- DependenciesIn place
Exact version locks, package behavior checks on every change, and a daily vulnerability scan.
- AI-assisted security reviewIn place
Models help find, prove and fix weaknesses. A person approves every merge and release.
- Static analysisIn place
Compiler, vet and race checks, plus AI-assisted security review, on every change.
- Secret scanningPlanned
Scanning of new code and history, with a response runbook.
Operations
- MonitoringIn place
Automated checks and error reporting cover the application, hosts, event flow and backups, with alerts.
- Incident responseIn place
A seasoned response team. Every incident gets a written postmortem and tracked fixes.
- Backups and point-in-time recoveryIn place
Several layers: a continuous change archive, full and differential backups, and automatic health checks. The primary database can be restored to a point in time.
- Regional failoverPlanned
Releases are health-gated and reversible. The core service runs in one region today.
- Vendor managementIn place
Providers that host or process platform data publish independent assurance, such as SOC 2 or ISO/IEC 27001. Integrations a customer picks, like their dialer, run under that customer’s own agreement.
- Vulnerability reportsIn place
Report issues to security@tapquality.com.
Policies and procedures
Written down, owned and reviewed
Each document has an owner and a yearly review. Version 1.0, effective 2 November 2026. Full documents go to organizations evaluating TapQuality.
Information security policy
Layered controls, least access, and a person’s approval on every change.
Access control policy
Sign-in with role checks, scoped machine keys stored one-way, and private administration.
Secure development policy
Automated build, test, dependency and security checks on every change, then human approval.
Data protection policy
Data classes, encryption in transit, encrypted credentials, and masked caller numbers with logged access.
Acceptable use policy
Named accounts, approved tools, and caller data kept out of AI tools and logs.
Incident response plan
Severity levels, roles, containment and recovery steps, customer notice, and a written review.
Backup and recovery procedure
Layered database backups, automatic health checks, and point-in-time restore steps.
Access review procedure
A quarterly review of who and what can reach production, and prompt removal for leavers.
Vendor register
Every provider that touches platform data, what it handles, and its independent assurance.
Self-hosted
Complete control of your data, on infrastructure you already trust
For HIPAA, we offer on-premises and self-hosted deployments. TapQuality runs on your existing BAA-covered infrastructure, and the data it stores stays there.
- On-premises, or in your own cloud account
- Covered by the BAAs you already hold
- Your keys, your backups, your access rules
For security-focused organizations
Hold us to your standard
If your organization sets a high bar for the platforms it trusts with caller data, we invite you to evaluate TapQuality against it.
Found a vulnerability? Read our disclosure policy and email security@tapquality.com with steps to reproduce. Please don’t access other customers’ data, and give us time to fix it before you share it.