Security
Security is an operating constraint, not a badge.
This page distinguishes safeguards implemented in the current code from controls that still depend on deployment, monitoring, and independent verification.
This is a release-candidate security statement, not a certification or warranty. Tactrail does not currently claim SOC 2, ISO 27001, PCI DSS certification, a completed independent penetration test, or formal compliance with a named security framework.
Current code
Safeguards implemented in the application
Workspace-scoped access
The application checks organization membership and role on the server. PostgreSQL row-level security provides a second tenant boundary for user-accessible records.
Connector secret handling
The global Shopify app secret stays in the server environment. Per-store access tokens are encrypted with authenticated encryption before persistence, and privileged database access is not exposed to the browser.
Authenticated integrations
Shopify, Stripe, and inbound-email endpoints validate their expected signatures or shared credentials before processing. Request-size limits and replay or duplicate controls are applied to these flows.
Controlled outbound email
AI auto-send is disabled by default. Draft, human-only, and category policies remain explicit, while durable delivery state prevents the application from blindly retrying an ambiguous email-provider result.
Additional application controls
- Public request and tracking URLs use opaque identifiers and do not intentionally place customer email addresses or order numbers in the URL.
- State-changing public flows use POST requests, with input validation, bounded payloads, throttling, and idempotency where the workflow can be repeated.
- Security headers restrict framing, object embedding, browser capabilities, referrer disclosure, and content-type sniffing. HTTPS and HSTS still have to be confirmed on the production hostname.
- AI generation fails closed when required order, conversation, or knowledge context cannot be loaded. Model output remains subject to deterministic guardrails and configured human review.
Shared responsibility
Tactrail customers control who joins a workspace, which stores and email domains are connected, the guidance supplied to the model, and which request categories may use automation. Customers should grant only the access their team needs, promptly remove departing users, keep Shopify and email accounts protected, and review draft quality before expanding autonomy.
The platform cannot make an unsafe store policy safe. Merchants remain responsible for the accuracy and legality of their customer communications, return rules, and commercial decisions.
Production verification still required
Before external production use, the operator must verify the real deployment rather than relying on source-code checks alone. Release gates include production migrations, TLS and DNS, sender-domain ownership, backup and restore, monitored alerts, incident ownership, provider access reviews, and end-to-end tests using non-production stores and mailboxes.
Vulnerability scanning and dependency checks reduce risk but are not a substitute for threat modeling and independent testing.
Last updated: . This page reflects the release-candidate code and must be rechecked against the deployed environment.