Security posture

What is in place

This website is static: there is no server-side code behind it, no form, no login and no third-party script. It is served through Cloudflare and loads only its own files.

In the application, every account requires a verified email address, and passwords are stored hashed. Sign-in is rate-limited rather than locked, sessions are limited to one active session per credential and expire after a fixed period, and a person can sign out of all of their own sessions at once. Two-factor authentication with an authenticator app and backup codes is available to any account.

API keys belong to a named person, not to an organization, are issued only to members an admin has enabled, are shown once and then only as a prefix, and can be revoked by the holder or an admin at any time. Requests are rate-limited per key and per organization, and the volume of data leaving through keys and exports is metered.

Card details are entered into a payment element served by Stripe and are never seen or stored by Data Tactical Group. State-changing actions in an organization are recorded in an audit trail that the organization’s owner and admins can see. Reads of personal data by Data Tactical Group staff are recorded in Data Tactical Group’s own internal audit trail, which customers do not see.

What is not claimed

Data Tactical Group does not hold a SOC 2 report, an ISO 27001 certification, FedRAMP or StateRAMP authorization, or a completed third-party penetration test, and has not published a VPAT. None of these has been done. A procurement that requires one should ask rather than assume.

Reporting a vulnerability

Report a security issue to support@datatactical.group with “Security” in the subject and enough detail to reproduce it. A person reads it. Please do not test against other customers’ accounts or data.

Data Tactical Group will acknowledge a security report within three business days. We ask that you give us a reasonable time to fix an issue before you publish it, and we will tell you when it is fixed. We do not offer a bug bounty. We will not pursue legal action against research carried out in good faith within the terms on this page.