Security at Tagile

We use safeguards appropriate to the nature of the service and the data processed. Security controls are reviewed as the product and the threat environment evolve, and we prioritise protecting the confidentiality and integrity of customer data in everything we build.

Tagile runs on established cloud infrastructure (Google Cloud Platform), with the aim of processing and storing primary customer data within the EU.

Data is encrypted in transit and at rest using industry standard encryption.

Users sign in over encrypted connections, and we apply protections against common attacks such as brute force sign in attempts.

Access to production systems is restricted to authorised personnel and follows the principle of least privilege: people and systems only get the access they need to do their job. Administrative access takes place over secure, logged connections.

Changes to the product go through review before release, and we aim to keep dependencies up to date and to address security relevant issues with priority.

We log security relevant events and monitor the platform to detect anomalies. Logs are handled with care so that they do not expose more customer data than necessary.

We maintain backup routines with the aim of enabling restoration of data in the event of loss.

We have a documented incident management process covering detection, containment, investigation, recovery and customer communication. See the Incident Response page.

We assess service providers before engaging them and bind subprocessors to data protection obligations. The current list is on the Subprocessors page.

Security is shared. Customers are responsible for keeping their credentials secure, assigning licences only to authorised users, reviewing AI generated content before use, and configuring integrations responsibly.

If you believe you have found a security vulnerability in Tagile, please report it to security@tagile.ai. We appreciate responsible disclosure and will respond as quickly as we reasonably can. Please do not run penetration tests against the Service without written approval.