Shared responsibility
Shared responsibility
Last updated: 2026-08-05
Most software-as-a-service has two zones: the vendor's platform and how you use it. Taiga has three, because the factory delivers software that then has to run somewhere and be owned by someone. This page says where each line falls. It describes practice; your signed agreement is what binds.
Three zones, not two
Read the split this way:
The Taiga platform. Ours, entirely. The infrastructure, the tenant boundary, the agents, the model access, the audit trail.
Your connected systems. Yours, entirely. Your directory, your repositories, your cloud account. We reach them only through grants you make and can withdraw.
The software the factory delivers. This is the zone that moves. We build it under your policies and produce the evidence; you review it, accept it, own it, and in most cases run it.
Who does what
| Area | Taiga | You |
|---|---|---|
| Platform infrastructure, patching, and its own security | Ours | Nothing to do |
| Tenant isolation and encryption inside the platform | Ours, enforced at the data layer | Nothing to do |
| What the agents may do and the permissions they hold | Ours, least-privilege by design | Decide which integrations to connect at all |
| Who holds a Taiga account, and with which role | Enforce the roles you set | Yours: grant, review, and remove access |
| Your identity directory, if you federate single sign-on | Accept sign-ins from the domain you verified | Yours: directory security, MFA, joiners and leavers |
| The GitHub App that reaches your repositories | Use only the scopes granted | Yours: install it, scope it, revoke it |
| What you upload or put into the platform | Process it to deliver the service | Yours: the right to process it, and its classification |
| Producing the delivered software under your policies | Ours, with the artifacts and audit trail | Set the policies the factory applies |
| Reviewing and accepting what the factory produces | Provide the evidence to review against | Yours: competent human review before production |
| Running the delivered software, Taiga Complete hosting | Ours for that environment | Nothing to do |
| Running the delivered software, your own cloud account | Build and deploy it as agreed | Yours: the account, the runtime, and its security |
| The security posture of your own cloud account | Nothing to do | Yours |
The one that matters most
Reviewing generated output is yours, and it is the responsibility easiest to let slide. The factory's output is probabilistic. It can be wrong, incomplete, or unsuited to your purpose. The specification, threat model, review gates, and audit trail exist to make that output reviewable by someone competent to judge it. They do not make it correct, and producing governance evidence does not transfer the judgement to us. A run that nobody read is not a governed run.
Hosting mode changes the line
Delivered software runs in one of two modes, chosen per connection. Under Taiga Complete, we run the environment and its security is ours. Under your own cloud account, we build and deploy into an account you control, and from the moment it runs there the runtime, the account, and its posture are yours. The code is the same; the responsibility is not. Check which mode a project uses before assuming either.
Data protection roles
For personal data in the platform you are the controller and we are the processor, acting on your documented instructions under the data processing agreement. That means you decide what personal data enters the platform and why, and you answer data subjects; we secure it, restrict it to your tenant, and help you respond. For personal data in software the factory delivers into your own environment, we are neither: that is your system.
Security incidents
An incident in the platform is ours to detect, contain, and tell you about, on the timetable your agreement sets. An incident in your directory, your repositories, your cloud account, or an application running in your environment is yours to run, and we help where the platform is involved. Tell us either way at security@tai.ga: an incident on your side can change what we should be watching on ours.
Vulnerabilities: platform against delivered software
Vulnerabilities in the platform are ours: scanned continuously, patched by us, disclosed under our vulnerability disclosure policy. Vulnerabilities in software the factory delivered are a different thing. The Operate loop can detect and propose fixes for them, and that is a service we run, not a warranty we give. Deciding to apply a fix, and to a system running in your environment, stays with you.
What this page is not
This is a description of practice, written so a security reviewer can see the boundary without asking. It does not vary your signed agreement, add obligations to either side, or replace the data processing agreement. Where it and your agreement differ, the agreement governs.
Contact
Questions about where a line falls go to security@tai.ga
Verified against the platform source and the services agreement, 2026-08-05. Where this page and your agreement differ, the agreement governs.