Procurement-grade trust.
Documented. Audited. Public.
Every commitment we make to enterprise evaluators, government agencies, and institutional partners - with plain-English documentation, downloadable artifacts, and live audit status.
Five deep-dives for procurement
Each section is a detailed, plain-English deep dive. Built for evaluators who need more than marketing copy.
Authentication and access control
Authentication runs on Supabase, our SOC 2 Type II certified backbone provider. Account credentials and session tokens never leave their infrastructure.
WCAG 2.2 Level AA conformance
Validated through automated accessibility testing on every release and documented in a formal VPAT. Marketing pages, authenticated dashboard, and every interactive component.
Known Limitations
Three areas carry “Partially Supports” status due to third-party component constraints. Full details, including remediation plans, are documented in the VPAT.
- Workflow canvas editor - The drag-based automation canvas has limited keyboard navigation for repositioning items. Surrounding controls and configuration panels remain fully accessible.
- Dashboard widget layout - Repositioning dashboard widgets requires drag interaction. Widget content and all data remain fully keyboard-accessible.
- Third-party embeds - Stripe’s payment form and Supabase’s sign-in components are maintained by their respective vendors. Both vendors publish their own accessibility documentation.
Org admins control deletion. Every action is reversible inside the recovery window.
When you delete a record, it leaves active views immediately and is retained for a recovery window before automatic purge. For GDPR / CCPA right-to-erasure, your admin can flag any record for 7-day fast-track deletion that overrides normal retention.
Full technical detail on how retention and recovery work is available in our documentation on request.
Every policy, published and versioned
All policies are available without authentication. Versioned in git, reviewed by counsel, and updated on cadence.
Terms of Service
Platform usage terms and conditions
Privacy Policy
How we collect, use, and protect data
Cookie Policy
Cookie usage and consent preferences
Data Processing Agreement
DPA for enterprise and institutional customers
AI Disclaimer
How AI is used across the platform
Acceptable Use Policy
Permitted and prohibited platform usage
SOC 2 Type II controls, in-progress audit
PCI DSS scope is limited to SAQ A (Stripe-hosted checkout). Additional security documentation is available under NDA.
| Control | Status |
|---|---|
| SOC 2 Type II (TappHQ) | Observation period - Type II report targeted Q4 2026 |
| SOC 2 Type II (Supabase backbone) | Independently certified - authentication infrastructure |
| PCI DSS | SAQ A (Stripe-hosted checkout) |
| Data encryption | AES-256-GCM at rest, TLS 1.3 in transit |
| Personal data protection | Field-level encryption, with SHA-256 hashing for sensitive identifiers |
| Penetration testing | Scheduled (summary available under NDA) |
| Upload protection | File type verification, local malware scanning, reputation check against known-malware hashes (MetaDefender Cloud), image injection screening |
External pen test scheduled. Engagement timeline available on request - contact compliance@tapphq.com.
Security inquiries: compliance@tapphq.com
Compliance and certifications
Active certifications, audit progress, and roadmap items - disclosed honestly so procurement evaluators can size risk without requesting follow-up.
Compliance documentation
Procurement-ready artifacts and policy links in one place. DPA available on request for enterprise and institutional customers.
Frequently asked questions
Procurement self-service. Questions evaluators ask most often, answered without an NDA - with a path to deeper detail when one is required.
Planned compliance additions
Artifacts queued for publication as TappHQ completes its audit and certification cycle.
Procurement question we haven't answered?
Request our full security review packet, vendor DPAs, and compliance artifact bundle. We acknowledge requests within three business days. No NDA required for the overview.