Trust

Security at Tappivo

Last updated: 20 September 2026

Tappivo is built and operated by TabSphere LTD. Security is treated as a platform property, not a feature: tenant isolation, least privilege and fail-closed behaviour are enforced in the database itself, not only in application code.

Architecture summary

• Tenant isolation by row-level security. Every business's data is isolated at the database layer: a signed-in owner can only ever read or write rows belonging to their own business, and anonymous visitors have no direct data access at all.
• Least-privilege access. Platform-controlled fields (business status, destination verification, administrative flags) cannot be written directly by customer sessions. Privileged changes flow exclusively through gated, audited server-side operations that re-check authorisation inside the database.
• Destination verification. A touchpoint only redirects to a destination that is active and platform-verified. Editing a destination URL automatically revokes its verified state until it is reviewed again.
• Fail-closed redirection. The tap/scan service returns a redirect only when every check passes — active touchpoint, active business, active and verified destination. Every other case resolves to a single neutral "unavailable" outcome that reveals nothing about which check failed.
• Privacy-preserving analytics. Interaction analytics never store raw IP addresses. Obvious automated traffic is flagged and excluded from counted figures, and write-amplification caps keep the redirection path fast and available under load.
• Audited administration. Administrative actions are recorded in an append-only audit trail that cannot be rewritten or deleted through customer-facing access paths.
• Transport and browser protections. The site is served over HTTPS with a strict content security policy and standard browser security headers.

Responsible disclosure

We welcome reports from security researchers and the wider community. If you believe you have found a vulnerability in Tappivo, please email security@tappivo.com with:

• a clear description of the issue and its potential impact;
• step-by-step reproduction instructions or a proof of concept;
• the affected component, URL or code path;
• your contact details and whether you wish to be credited.

We ask that you:

• give us a reasonable opportunity to investigate and fix the issue before any public disclosure;
• test only against your own account and data, using the minimum access necessary;
• avoid denial-of-service testing, spam, or automated scanning that degrades the service.

You will receive an acknowledgement of your report. We do not currently operate a bug bounty programme, but we treat credible reports with urgency and are happy to credit researchers who follow coordinated disclosure.

Questions

For security concerns about your account or data, contact security@tappivo.com. For anything else, see our contact page.