Security information

How Tangle protects its services

This page describes the security practices currently used for Tangle-operated services. It is not a certification statement or a guarantee of uninterrupted security.

Tangle completed a SOC 2 Type II examination with A-LIGN covering June 14 to September 14, 2026; the report is in issuance. Current control status, the subprocessor list, and security FAQs are published on theTangle Trust Center. A Data Processing Agreement is available from [email protected].

Access and identity

Production administration is restricted to authorized personnel. Administrative access uses multi-factor authentication where the provider supports it, and production Linux hosts do not accept SSH password authentication. Tangle periodically reviews administrative access to its cloud, source-control, and collaboration systems.

Infrastructure and data protection

Public services use TLS in transit. Managed stores and Restic backups are encrypted at rest. Two self-managed dedicated hosts lack full-disk encryption and remain an open risk; the staging pair was decommissioned in September 2026. Backups run on scheduled jobs with retention rules, and restoration tests verify that backed-up database data can be read in an isolated environment.

Application security

Tangle uses source-control review, automated dependency monitoring, and vulnerability remediation workflows for its maintained repositories. Authentication endpoints enforce rate limits, and administrative actions are recorded in application audit logs.

Monitoring and incident response

Tangle collects application, database, operating-system, and edge-provider audit data. Security-relevant alerts and incidents are investigated according to the company incident-response process. Public service checks are published on the status page.

Report a vulnerability

To report a suspected vulnerability, email [email protected]. Do not include credentials or sensitive customer data in the initial report. We will acknowledge the report and coordinate a safe remediation path.