Security questions
Security questions, answered
Last updated: 2026-08-13
These are the questions security reviews actually ask. They are answered here so you do not have to send a spreadsheet to get them, and so the answers are the same for everyone. Where something is not true yet, it says so. The deeper detail lives in our system description, which your security team can request.
Data and residency
Where is our data processed and stored?
AWS eu-central-1, Frankfurt. Customer data at rest — the database, uploaded documents, object storage, and the encryption keys — is held there, and the application runs in the same region.
Does anything leave the EU?
No customer data leaves the EU. Two qualifications we state rather than bury. Model inference uses Bedrock cross-region inference within the EU, so prompts and responses may be processed in another EU region for capacity and resilience; nothing is persisted there and nothing leaves the Union. And the CloudFront TLS certificate is managed in a US region because the provider requires it, which is certificate metadata and never customer data. EU-only operation is enforced at the infrastructure boundary by organization-wide guardrails that deny non-EU regions, not by policy alone.
Where do our code and data live?
It depends which tier you are on. By default your code stays in your own GitHub, behind an App you install and can revoke, and the platform never holds a copy of your repo. Under Taiga Complete, Taiga provides and hosts the repository instead, in the EU; hosting it does not change who owns the code, which your agreement governs. Built applications deploy to your cloud account, or, under Taiga Complete, to one Taiga hosts. Customer data at rest stays in AWS Frankfurt.
AI and models
Which models does Taiga use?
Anthropic Claude, reached exclusively through Amazon Bedrock, with inference inside EU regions. Nothing is self-hosted and there is no second provider.
Is our data used to train models?
No. Amazon Bedrock does not use prompts or outputs to train foundation models, and an organization-wide policy opts Taiga out of AWS AI services using its content. Zero customer data is used for model training, ours or anyone else's.
What can the agents do, and what stops them doing more?
They act only inside your tenant, with the permissions their task needs and no more. Agents run on a private network with no inbound internet path, under IAM, and are invoked only by the API, never directly by a browser. Retrieval is scoped to your tenant, so one tenant's agents cannot reach another's documents. The coding agent reaches your repositories only through the GitHub App you installed, with the scopes you granted, in an isolated per-build workspace, and you can revoke it at any time.
Are Bedrock Guardrails enforcing?
No, not at the moment, and we will not claim otherwise. Two profiles are built and versioned — one for user-facing agents including prompt-attack detection and credential, card and national-ID blocking, and one for backend agents — and that layer is switched off in every environment, production included, while support cases with AWS are open. It is a layer on top of the controls that carry the surface, and those are enforcing: retrieval is scoped to your tenant, agents run least-privilege and are invoked only by the API, and agent output is validated at the API layer. This answer changes the day the switch flips back.
What is your position on the EU AI Act?
Article 50(1) is addressed; Article 50(2) is open. Our platform terms state plainly that you are interacting with an AI system and that the factory's artifacts are AI-generated, which covers the transparency duty. Article 50(2) asks that synthetic output carry machine-readable marking, and whether that duty reaches generated source code, rather than media a person could mistake for authentic, is unsettled. We are working it through with counsel and will state our position here once we have one, rather than asserting an answer in either direction today.
Isolation and access
How is tenant data isolated?
At three layers, starting in the database itself. Row-level security scopes queries to your tenant at the database rather than only in the API, and it is enabled on every table that holds customer content; the few that sit outside it are the tenant registry, the global permission catalog, and request plumbing, none of which hold your data. Uploaded documents live under per-tenant S3 prefixes, encrypted with a dedicated customer-managed key. Retrieval filters by tenant, so your documents never appear in another tenant's context.
How do users authenticate? Do you support SSO?
Amazon Cognito, with optional Microsoft Entra ID or Google SSO for your organization. Taiga never stores or sees raw passwords. Passwords are a minimum of 12 characters with mixed case, numbers and symbols, and adaptive risk and compromised-credential detection run in enforced mode. Access and ID tokens last 15 minutes, refresh tokens 7 days, and revocation is enabled. Entra ID federation covers an email domain your organization has verified by DNS. SAML and SCIM provisioning are not built yet.
Who at Taiga can access our data?
A small number of operators, through single sign-on with MFA, and never standing database access. Operator access to AWS is through IAM Identity Center with scoped permission sets. There are no long-lived IAM users for day-to-day work, no SSH, and no bastion with open ports. Database administration is an on-demand task opened through AWS SSM and gone when the job is done. The application's own database role cannot bypass tenant isolation; a separate administrative role is used for migrations. Root account use is emergency-only, hardware-key protected, carries no access keys, and every root sign-in alerts the security team.
Retention, deletion, and getting your data back
How long do you keep our data?
It depends on the data. Account and project data is held for the life of the contract; everything else is on a fixed schedule.
| Data | Kept for |
|---|---|
| Account and project data | The life of the contract |
| Database backups (point-in-time) | 30 days in production |
| Uploaded document versions | 30 days after they stop being current |
| Control-plane audit logs | 7 years, isolated immutable archive |
| Operational logs | 365 days in production |
How do we get our data deleted?
A tenant owner instructs erasure in the product, and it completes within 35 days. A 30-day grace period follows the instruction, during which the tenant stays fully usable and the instruction can be cancelled. After that a worker purges tenant data across the database, object storage, the identity pool, and the knowledge base, tombstones the tenant record, and issues a signed deletion certificate recording what was deleted. Production data goes immediately; residual encrypted backups age out within 35 days, which is the maximum recovery window of the underlying database, so the commitment is one the infrastructure can actually keep. A legal hold blocks the whole pipeline.
Can we export our data?
Yes, as a self-service product feature. A tenant owner can export the tenant as an archive, downloaded through a short-lived signed link. It is a product feature rather than a support request, which is what makes it useful for your portability obligations.
How it is run
Is our data encrypted?
Yes, in transit and at rest, with a dedicated customer-managed key for your documents. In transit it is TLS 1.2 or better at the edge, with database connections requiring TLS and AWS service calls going over private endpoints rather than the public internet. At rest the database is KMS-encrypted, uploaded documents and their derived embeddings use a dedicated customer-managed key with automatic rotation, and buckets, container images and secrets are encrypted. Unencrypted or public storage is denied organization-wide by policy, so it is not something a team can forget.
What is logged, and for how long?
Control-plane activity, database access, network flow and application logs. Alarms cover error rates, latency, database health, and unhealthy hosts.
| What | Retained |
|---|---|
| Control-plane API activity | 7 years, organization trail to an isolated archive account with log-file validation, KMS encryption and object lock |
| Database access and DDL | Audited with pgaudit |
| Network flow logs | 365 days in production |
| Application, API and load-balancer access logs | 365 days in production |
How do you handle vulnerabilities and patching?
Scanned on every pull request and daily, with patching of managed services handled by AWS. Every pull request to the main branch runs static analysis, secret detection, and dependency scanning, with a daily scheduled scan as well. Container images are scanned on push and continuously afterwards, alongside functions and hosts. Configuration is watched against CIS and AWS foundational benchmarks with drift flagged. Infrastructure is Terraform, peer-reviewed before it deploys, so the change history is reviewable.
What is your availability and backup posture?
Multi-AZ in production, with backups in a separate account — and no contractual uptime commitment on beta terms. The application tier runs across two availability zones and the database runs a writer and a reader across two. Backups are automated, encrypted, point-in-time for 30 days, and copied into a separate isolated account protected by its own key, so they survive a compromise of the workload account. Deletion protection is on. We will not imply a service level we have not signed; where one applies it comes from your agreement.
Can Taiga run without internet access?
The platform is a managed EU SaaS, so no, and we will not pretend otherwise. The systems it delivers deploy into your environment under your network policy. If a managed platform is off the table for you, tell us what is on it.
Assurance
Are you ISO 27001 certified?
No, and you will not see the logo here until we are. The ISMS is established and running, with policies, an active risk register, and vendor management; certification is in progress and SOC 2 Type II is planned. The platform runs on AWS, whose own ISO 27001, SOC 1, 2 and 3, and C5 reports are available through AWS Artifact and can support your assessment of the underlying infrastructure.
Do you have a penetration test report?
No third-party penetration test has been carried out yet, and we would rather say that than let the scanning list imply otherwise. What runs today is continuous automated scanning of images, functions and hosts, static analysis and secret detection on every pull request, threat detection across all accounts, and posture monitoring against CIS benchmarks. When a test is commissioned, the summary will be available here on request.
Who are your subprocessors, and how are we told about changes?
The full list is public on our subprocessors page, and we tell you before it changes. It is principally AWS for infrastructure, storage, identity and inference, with Anthropic models reached through Bedrock, GitHub for the repository access you grant, and Google for optional SSO and agent documentation lookups. You can object on reasonable grounds within the notice period your data processing agreement sets.
What happens if there is a breach?
We notify you without undue delay, on the timetable your data processing agreement sets. The notification covers what happened, the categories and rough numbers affected, the likely consequences, and what we have done. As the controller, you decide on notification to the supervisory authority and to individuals. We act as processor and support you in it.
Can we audit you?
Yes, on the cadence and notice your data processing agreement sets. In practice we offer the system description and, in time, an audit report first, because that usually answers the question faster for both sides.
Not answered here?
Send the question to security@tai.ga
We would rather add it to this page than answer it privately twice. If your security team needs the full detail, the system description covers all of this in fifteen sections and is available on request.
Every answer verified against the platform source or the system description, 2026-08-13. Where something is not true yet, the answer says so.