Protecting sensitive board information is our highest priority. Tutaki uses industry-standard encryption, strong access controls, and audited operational practices to safeguard your data. For authoritative details (certifications, policies, audit artifacts), see the Tutaki Trust Center.
Product security (in-app controls)
Authentication & MFA: Sign-in requires email + MFA (SMS/email). SSO with Google/Microsoft can be enforced by admins.
Least-privilege access: Role-based permissions at the workspace, company, board, and meeting levels.
Session security: Device remembering (policy-bound).
Data minimization features: Download/export controls and scoped sharing via links that respect permissions.
Data protection
Encryption: Data is encrypted in transit and at rest.
Backups & recovery: Regular backups and tested restore procedures, details in the Trust Center.
Data retention & deletion: Workspace-level retention, soft-delete and purge workflows, and customer-requested deletion—see policy specifics in the Trust Center.
Data residency: Region options may be available; check the Trust Center for current locations and eligibility.
Compliance & assurance
Certifications & reports: Current certifications, audit periods, and reports are listed in the Trust Center - SOC 2 Type II, ISO 27001, HIPAA, GDPR.
Privacy: DPA, SCCs (where applicable), and privacy commitments are available there.
Subprocessors: We publish and maintain a subprocessor list with purpose and region, subscribe to updates via the Trust Center.
Vulnerability & incident management
Secure development & testing: Continuous scanning, code review, and environment hardening.
Third-party testing: External testing and assessments are summarized in the Trust Center.
Responsible disclosure: Security researchers can report issues via the process described in the Trust Center.
Incident response: Defined procedures for detection, containment, customer notification (as required), and post-incident review.
Customer responsibilities (shared responsibility model)
Enforce SSO/MFA for all members.
Use least-privilege roles; review board/meeting/document access regularly.
Keep device and email security strong (mail filtering, MDM, patching).
Govern exports and external sharing according to your internal policies.