How Tapper secures your data
Tapper processes your traffic and ad account data on Google Cloud in the EU, encrypted in transit and at rest, with every record scoped to your account. The controls below are the ones Tapper publishes on its Security page at <https://tapper.ai/security>.
Where your data is processed
Tapper runs on Google Cloud in europe-west1. In the Security page's words: "Data is processed on Google Cloud in europe-west1, encrypted with AES-256 at rest and TLS 1.2 or higher in transit, in tenant-scoped storage with row-level filtering on your account ID."
"Data is retained for a default of 12 months, configurable per agreement."
What comes in and what goes out
- In: "Your site's monitoring script, your ad account APIs, an MMP postback you already send, or a read-only Salesforce connection." Input fields on your site are redacted.
- Out: "Only the outputs you configure leave Tapper: IP exclusions and blocked audiences to your ad accounts, and conversion values with a click ID to Google Ads. No email, phone, hash, name or CRM content is sent."
What Tapper reads and changes on each platform is listed in What access Tapper asks for on each platform and what it does with it.
Four layers of protection
| Layer | What the Security page states |
|---|---|
| Encryption | "TLS 1.2 or higher in transit, AES-256 at rest including backups, keys held in Google Cloud KMS, HSTS enabled." |
| Controlled access | "Least privilege, unique accounts, no direct employee access to production data without explicit and temporary approval, public SSH disabled." |
| Authentication | "Multi-factor authentication on accounts, single sign-on through centralized identity providers, automatic session lock." |
| Continuous review | "Continuous monitoring and logging, automated vulnerability scans at least quarterly, a web application firewall, an annual independent penetration test and an annual risk assessment." |
Tenant segregation
"Every record is tagged with your account ID, every API request is scoped to your tenant, and no cross-tenant read or write is possible at the application level."
SOC 2 Type II and privacy law
- SOC 2 Type II: "Our security program is designed to meet SOC 2 Type II requirements, and we maintain SOC 2 policies and control procedures." Tapper's cloud infrastructure is linked to Drata, a security and compliance platform.
- GDPR and CCPA: "Tapper acts as a processor under GDPR and a service provider under CCPA." What that means for the personal data in your traffic is in GDPR and CCPA: how Tapper handles personal data.
Protect your own workspace
Some controls are in your hands:
- Turn on two-factor authentication with an authenticator app: Turn on two-factor authentication (2FA).
- Have your team sign in through your company's identity provider: Set up single sign-on (SSO) for your workspace.
- Give people the least access they need. Editor members can see but not change anything: Roles: what Owners, Admins and Editors can do.
- Treat API keys like passwords. A key is shown in full only once, and you can delete one at any time: Create and manage API keys.
Security documents and questionnaires
A security report and a risk-assessment questionnaire are available on request. To ask for them, or to send your own security questionnaire, write to support@tapper.ai.
Related
Was this helpful?
Related articles
Still need help?
Chat with our team and mention this article.