Trust Center

Append-only audit trail of mutations and security events, retained for at least 12 months.

Every credential sign-in is logged with outcome; lockout after repeated failures.

Length, complexity, history, and optional breach-check enforced on every change.

Fine-grained, feature-scoped permissions with workspace boundaries.

Self-service account deletion with a configurable grace period; anonymisation fallback for records on legal hold or referenced by business data.

Records can be placed under legal hold to override retention and deletion.

Versioned privacy policy, terms, DPA, cookie policy, and security overview.

Self-service data export and admin DSAR queue with 30-day SLA tracking.

Granular consent purposes, append-only consent ledger, and a cookie banner.

Public list of sub-processors with notification mechanism for changes.

TOTP enrolment with single-use backup codes; can be required for super-admins, for all users, or per workspace.

Active session listing, sign-out everywhere, configurable idle timeout.

Per-entity retention rules executed by scheduled sweeps and logged for evidence.

AES-256-GCM helper available for OAuth tokens and integration credentials.

TLS 1.2+ enforced on all public endpoints; HSTS enabled.

Scheduled workspace backups with retention and restore tooling.

Incident workflow with the GDPR 72-hour notification deadline and, for significant incidents, the NIS2 early warning (24 h), incident notification (72 h) and final report (one month).

CSV exports of audit log, DSAR log, consent ledger, login audit, retention sweep history and access review.

All entity changes logged via change log; release process documented.

Application logs, error events, and external log destinations.

A published coordinated disclosure policy (SECURITY.md) and a single contact, security@taion.fi, advertised by every installation at /.well-known/security.txt.

Fixed vulnerabilities are published as advisories with the affected and fixed versions, severity and mitigation, on a public page and a JSON feed, and shown to the installations they apply to.

Signed releases delivered through the hub; installations stage updates automatically and, by default, apply security-only releases on their own, with an opt-out and the option to postpone by pinning a release.

Security updates for the product until at least December 2032; each release is supported until 90 days after the next one. Installations show their support status.

Every release, and every marketplace plugin package, carries a CycloneDX SBOM of its components; the release SBOM is covered by the release signature.

Actively exploited vulnerabilities and severe incidents are tracked against the 24-hour, 72-hour and final-report deadlines, with alerts to the security team, and reported to CSIRT-FI.

Each release is audited for known vulnerabilities in what it ships; it is not built while one has no analysis showing it is not exploitable here, and the analyses ship in its SBOM.

Operators and workspace admins are notified of super-admin sign-ins from new addresses, impersonation and account lockouts.

CSV of every member's role, permissions, two-factor status and last sign-in, per workspace and installation-wide.