This page describes how Tamaat Inc. protects the data our customers keep in Tamaat, and how to report a security problem to us.
1. Where your data is kept
Tamaat runs in data centres in Canada, in Montreal and Toronto. Your datasets, maps, dashboards and files are stored there. Published maps and dashboards are delivered to their viewers through a global network of edge locations.
2. How we protect it
- Encryption
- What we doData is encrypted in transit and at rest.
- Separation
- What we doEach organization's data is kept apart from every other organization's. A member sees only what their role allows.
- Signing in
- What we doPasswords are protected. Multi-factor authentication is available. Sessions end after a period without use.
- Keys
- What we doAPI keys you create can be revoked at any time. Keys you give us for other services are stored encrypted.
- Our staff
- What we doAccess to customer data is limited to what a task requires.
- Records
- What we doAdministrative actions in your organization are recorded, and our systems are monitored.
- Backups
- What we doDatabases are backed up automatically. Backups are encrypted and expire after 14 days.
- Payments
- What we doCard details are handled by our payment provider and never reach Tamaat.
3. What you can do
- Turn on multi-factor authentication for your account.
- Give each person their own account, with the lowest role that lets them do their work.
- Review who you have invited and what you have published, and remove what is no longer needed.
- Keep API keys out of public code, and revoke a key you no longer use.
4. If something goes wrong
If we learn that your data has been lost, or accessed or disclosed without authorization, we tell the owners of your organization without undue delay, and the privacy regulators where the law requires it. The Data Processing Addendum sets out what we tell you.
5. Reporting a vulnerability
If you have found a security problem in Tamaat, write to security@tamaat.com. Tell us what you found, where, and the steps that reproduce it. We acknowledge a report within 5 business days and keep you informed while we fix it.
We will not take legal action against you, or ask anyone else to, for research that follows these rules:
- test only against accounts and organizations that are your own;
- do not read, change or delete data that is not yours, and stop as soon as you see any;
- do not degrade the Service: no denial-of-service testing, no automated scanning at volume;
- do not use social engineering against our staff or our customers, and do not attempt physical access;
- give us a reasonable time to fix the problem before you tell anyone else about it.
We do not run a paid reward programme. With your agreement, we are glad to thank you by name.
6. Contact
Security reports: security@tamaat.com. Tamaat Inc., 687 Arbour Lake Dr NW, Calgary, AB T3G 4T6, Canada.