How Tapper secures your data
On this page
Tapper follows SOC 2 Type II. These are the controls Tapper publishes on its Security page at tapper.ai/security.
Where your data is processed
Core processing runs on Google Cloud in the EU, encrypted with AES-256 at rest and TLS 1.2 or higher in transit, in tenant-scoped storage with row-level filtering on your account ID. For retention, see How long data is kept.
What comes in and what goes out
- In: your site's monitoring script, your ad account APIs, an MMP postback you already send, or a read-only Salesforce connection. Input fields on your site are redacted.
- Out: only the outputs you configure: IP exclusions and blocked audiences to your ad accounts, and conversion values with a click ID to Google Ads. No email, phone, hash, name or CRM content is sent.
What access Tapper asks for on each platform and what it does with it lists what Tapper reads and changes.
Four layers of protection
| Layer | What Tapper does |
|---|---|
| Encryption | TLS 1.2 or higher in transit, AES-256 at rest including backups, keys held in Google Cloud KMS, HSTS enabled. |
| Controlled access | Least privilege, unique accounts, no direct employee access to production data without explicit and temporary approval, public SSH disabled. |
| Authentication | Multi-factor authentication on accounts, single sign-on through centralized identity providers, automatic session lock. |
| Continuous review | Continuous monitoring and logging, automated vulnerability scans at least quarterly, a web application firewall, an annual independent penetration test and an annual risk assessment. |
Tenant segregation
Every record is tagged with your account ID, every API request is scoped to your tenant, and no cross-tenant read or write is possible at the application level.
SOC 2 Type II and privacy law
- SOC 2 Type II: policies and control procedures are documented in the policy pack.
- GDPR and CCPA: Tapper is a processor under GDPR and a service provider under CCPA. See GDPR and CCPA: how Tapper handles personal data.
Protect your own workspace
- Turn on two-factor authentication with an authenticator app: Turn on two-factor authentication (2FA).
- Have your team sign in through your company's identity provider: Set up single sign-on (SSO) for your workspace.
- Give people the least access they need. Viewer members can see but not change anything: Roles: what owners, admins, managers and viewers can do.
- Treat API keys like passwords. A key is shown in full only once, and you can delete one at any time: Create and manage API keys.
Security documents and questionnaires
A security report and a risk-assessment questionnaire are available on request. To ask for them, or to send your own security questionnaire, write to support@tapper.ai.
Related
Was this helpful?
Still need help?
Chat with our team and mention this article.