This page summarizes Talarity's security commitments. For program-level detail, see our Trust Center.
1. Encryption
All data in transit is protected with TLS 1.3. Data at rest is encrypted with AES-256. Customer-managed encryption keys, provided through Google Cloud KMS, are available under Enterprise Governance program terms.
2. Authentication
SSO via SAML 2.0 and OIDC. SCIM 2.0 user provisioning. Optional or enforced TOTP-based MFA. App Check on every callable endpoint.
3. Access control
Role-based access control with three-layer enforcement (route registry, dispatcher, handler). Org-group-based feature gating. Least-privilege defaults.
4. Audit logging
60+ event types are captured in immutable, hash-chained audit logs. Logs are exportable via UI and API.
5. Vulnerability management
Regular vulnerability scanning, patch management on a defined SLA, and annual third-party penetration testing.
6. Incident response
Documented incident-response procedures with defined roles, escalation paths, and customer-notification commitments. Material incidents are reported to affected customers within applicable regulatory windows.
7. Vendor management
Sub-processors are vetted, contracted with appropriate DPAs, and listed publicly at /legal/sub-processors.
8. Reporting a vulnerability
We run a coordinated vulnerability disclosure program with safe-harbor protection for good-faith research. Submit through our vulnerability report form (anonymous reporting supported) or email security@talarity.com. We acknowledge promptly and resolve high-severity issues within a published SLA. See our Responsible Disclosure Program for scope, safe-harbor terms, and our disclosure timeline.