Security

How TATER protects your compliance data and infrastructure.

TLS 1.2+ AES-256 Encryption Azure Cloud Entra ID Auth RBAC Enforced Tenant Isolation Signed Binaries

Encryption

All data is encrypted in transit using TLS 1.2+ and at rest using AES-256 encryption via Azure Cosmos DB and Azure Storage built-in encryption.

Authentication

Sign-in uses Microsoft Entra ID (Azure AD) with OAuth 2.0 / OpenID Connect by default, so TATER never sees or stores your directory password. OpenID Connect (OIDC) single sign-on against your own identity provider and SCIM 2.0 provisioning are available for enterprise identity. Optional local accounts store only bcrypt-hashed credentials, and TATER Vault secrets are encrypted client-side (zero-knowledge).

Multi-Tenant Isolation

Each organization's data is logically isolated using tenant-specific partition keys. Server-side authorization ensures users can only access their organization's data.

Role-Based Access

Fine-grained role hierarchy (SuperAdmin, ServiceProvider, OrgAdmin, Auditor, Viewer) controls access at the organization and feature level, plus granular permission bundles that scope individual members to specific modules and actions — all enforced server-side.

Infrastructure

TATER is hosted entirely on Microsoft Azure infrastructure:

Frontend: Azure Static Web Apps with global CDN distribution and automatic SSL certificates
API: Azure Functions (Node.js/TypeScript) on premium dedicated instances with an always-ready instance — no cold starts
Database: Azure Cosmos DB with automatic failover, backup, and geo-replication capabilities
Authentication: Microsoft Entra ID with JWT token validation on every API request

API Security

Every API request is authenticated and authorized through a multi-step process:

JWT tokens are validated on every request, including signature, issuer, audience, and expiration
Organization membership is verified server-side before granting access to any tenant data
API keys provide an additional authentication layer for agent and integration access, and are stored only as SHA-256 hashes
Rate limiting and request validation protect against abuse
Audit events can be forwarded to your SIEM over syslog (CEF) or HMAC-signed webhooks

Compliance Agent Security

The optional TATER Compliance Agent is designed with security as a priority:

Runs with minimal required privileges on endpoints
Communicates exclusively over HTTPS with certificate validation
Collects only the specific system configuration data defined by scan commands
Does not persist sensitive data locally - results are transmitted and discarded
Distributed as an MSI installer for Windows plus native macOS and Linux binaries, with SHA-256 integrity verification on every auto-update
The Windows MSI and agent executable are Authenticode-signed via Azure Trusted Signing (publisher: TATER Security, LLC) with timestamped signatures, so endpoints see a verified publisher rather than an Unknown Publisher warning

Data Protection

Deleted records are soft-deleted to a recycle bin with a 30-day retention period before permanent removal
Azure Cosmos DB provides automatic backups with point-in-time restore capability
Audit logs track administrative actions and configuration changes
Data export capabilities allow organizations to retrieve their data at any time

Responsible Disclosure

If you discover a security vulnerability in TATER, please report it responsibly by contacting security@tatersecurity.com. We ask that you allow us reasonable time to investigate and address the issue before public disclosure. Our full vulnerability disclosure policy is published in the Trust Center.

Trust Center

This page summarizes our core practices. For the full trust statement CISOs and procurement teams review — data residency, audit log integrity (HMAC signing), signed binaries, SBOM availability, subprocessors, and attestation status — see the TATER Trust Center.