Trust
Security
Last updated 1 June 2026
Funnels sit on the front of your website and collect leads, so they are worth attacking. Here is what we do about that.
1. Certifications and reports
| Programme | Status | Refreshed |
|---|---|---|
| SOC 2 Type II | Report available under NDA | Annually, 12-month window |
| ISO/IEC 27001 | Certified | Annual surveillance audit |
| GDPR & UK GDPR | DPA with SCCs and UK Addendum | Reviewed continuously |
| CCPA / CPRA | Service provider terms | Reviewed annually |
| Penetration test | Independent, full-scope | Annually plus after major releases |
2. Platform architecture
- Data encrypted in transit with TLS 1.3, and at rest with AES-256.
- Choose your data region at workspace creation — EU (Frankfurt) or US (Oregon). Funnel data stays there at rest.
- Tenant isolation enforced at the query layer and verified by automated tests on every deploy.
- Secrets held in a managed vault with automatic rotation; no secrets in source control.
- Backups encrypted, taken continuously, restore-tested quarterly. Recovery objectives: RPO 5 minutes, RTO 4 hours.
3. Access control
Staff access is least-privilege, granted by role, reviewed quarterly and revoked within one hour of departure. Every employee uses SSO with a hardware security key — passwords alone do not open anything. Production access requires an approved ticket, is time-boxed, and is logged with the session recorded.
On your side: role-based permissions on every plan, SAML SSO and SCIM provisioning on Enterprise, and an audit log you can export.
4. How we build
- Every change is peer-reviewed before merge; nobody deploys their own unreviewed code.
- Static analysis, dependency scanning and secret detection run in CI and block the pipeline on high-severity findings.
- Infrastructure is defined as code and changes go through the same review path.
- Separate development, staging and production environments. Production data is never copied into the others.
5. Monitoring and response
Centralised logging with tamper-evident retention for 12 months, anomaly alerting, and an on-call rotation staffed 24/7. We run a documented incident response plan and rehearse it twice a year. Confirmed personal data breaches are reported to affected customers without undue delay and within 72 hours of becoming aware, with the facts we have at the time rather than a polished summary a week later.
6. Responsible disclosure
In scope: tap-next.co, app.tap-next.co and published funnel domains. Out of scope: denial of service, social engineering, physical attacks, and automated scanner output without a working proof of concept. Please do not access other people’s data — use your own test workspace. We pay bounties for valid findings on a severity scale and credit researchers publicly if they want it.
7. Vendor management
Every sub-processor is security-reviewed before onboarding and re-reviewed annually. We prefer vendors with their own SOC 2 or ISO 27001 attestation, and we require breach notification terms at least as strict as our own. The current list is in the DPA.
8. How to reach us
Questions about this document go to security@tap-next.co, or by post to either entity below. We answer legal and privacy mail within five business days.
| Entity | Role | Address |
|---|---|---|
| Tap Next, Inc. | Contracting entity | 1 Sansome Street, Suite 3500, San Francisco, CA 94104, United States |
| Tap Next Europe B.V. | EU/UK representative (Art. 27 GDPR) | Herengracht 124, 1015 BT Amsterdam, Netherlands |