Security at TACTIC
Your venture data is sensitive. This page sets out what protects it, and what we do not yet have.
Our Security Practices
Data Encryption
- • TLS 1.2 or better in transit, with TLS 1.3 negotiated by any current browser
- • Our hosting and database providers encrypt data at rest with AES-256. That is their published statement about their platforms, not an arrangement we negotiated, and we cannot demonstrate it ourselves.
- • SSL enforced on database connections, so a plaintext connection is refused
Infrastructure Security
- • Our hosting platform holds SOC 2 Type II. TACTIC is not itself certified.
- • Our database provider holds SOC 2. TACTIC is not itself certified.
- • Our hosting platform applies security updates and DDoS mitigation.
Authentication & Access
- • Secure password hashing (bcrypt)
- • Session-based authentication
- • Role-based access control
- • Secure password reset flows
Data Protection
- • Point-in-time recovery over the last seven days, run by our database provider. A full restore from it to a separate database was drilled on 27 September 2026 and matched production’s record counts and identifiers.
- • Data isolation between users
- • Export your data, or delete your account and its assessments, from your account settings. Payment and invoice records are kept, detached from your account, as accounting records.
Model Processing Security
TACTIC uses language models for venture assessments. Here's how we protect your data while the model is processing it:
- ✓No training on your data: Your venture submissions are not used to train models
- ✓Secure API communication: All API calls use encrypted HTTPS connections
- ✓Model provider: Our model provider holds SOC 2 Type II. That is their certification, not ours.
- ✓Data retention limits: Under our model provider's published policy, the inputs and outputs of an API request are deleted within 30 days, and are never used to train a model without our express permission. That is their commitment, stated by them, not an arrangement we have negotiated separately. Where their automated trust and safety systems flag a request, they may hold it for up to two years.
Payment Security
Payments are processed by a PCI DSS Level 1 certified payment processor. That is their certification, not ours, and it is the reason we never see or store a card number:
- • We never store your full credit card number on our servers
- • All payment data is handled directly by our payment provider's secure infrastructure
- • Industry-leading payment processing trusted by millions of businesses
- • 3D Secure authentication for additional fraud protection
Responsible Disclosure
Help us keep TACTIC secure
We appreciate the work of security researchers who help identify vulnerabilities. If you discover a security issue, please report it responsibly:
- • Email us at security@tactic.science
- • Provide detailed steps to reproduce the vulnerability
- • Allow us reasonable time to address the issue before disclosure
- • Do not access or modify data belonging to other users
We will acknowledge your report and keep you updated on remediation.
Certifications
TACTIC holds no security certification of its own today. The certifications named on this page belong to our hosting platform, our database provider, our model provider and our payment processor, and we hold none of them by association. We would rather say that here than have you find it in diligence.
- • SOC 2 Type II: not started, and not committed to a date.
- • ISO 27001: not started, and not committed to a date.
- • Penetration test: none commissioned to date.
If a procurement process needs a certification we do not hold, tell us which one and by when, and we will give you a straight answer about whether we can meet it rather than a roadmap.
Questions About Security?
Our team is happy to answer any questions about our security practices.
Contact Security Team