Data in transit and at rest
All traffic is served over HTTPS with HSTS. Database connections are encrypted. API keys are stored only as SHA-256 hashes.
Access control
Role-based permissions inside each organization, sign-in throttling, optional single sign-on through Authpermit, and sessions that can be revoked.
Application security
A strict Content-Security-Policy, CSRF protection on every form, signed webhooks, and per-key rate limits on the API.
Privacy by design
Meeting recordings never leave the participant's device. Personal pages are never cached by the offline app.
Reporting a vulnerability
Email security@tariffapis.com. We acknowledge reports within two business days.