What we capture, how we protect it, who touches it.
A two-minute summary for security and data-protection reviewers. It describes what the product does today; planned items are marked as planned.
Last updated 2026-10-08 · applies to Tacet and the Tacet Chrome extension
- At a glance
- What we capture, and never capture
- How data is protected
- Access and sign-in
- AI providers and training
- Sub-processors
- Your controls
- Status of certifications
- Report a vulnerability
At a glance
- Per-site opt-in. The browser extension captures only on sites a person switches on, plus Tacet's own demo desk.
- Scrubbed before storage. The server removes IBANs, payment cards, emails, phone numbers, tax ids and secret-bearing URLs before anything is stored or sent to an AI provider.
- Encrypted. TLS in transit. Sensitive content is encrypted at rest with AES-256-GCM using a separate key per workspace.
- Isolated. Every record belongs to one workspace, every request is authenticated, and cross-workspace access is tested on every endpoint.
- No training on your data. Tacet does not train models on customer data, and our AI providers' API terms exclude training on API data.
- You control it. Any member can download all workspace data as JSON and delete the workspace in the app.
What we capture, and never capture
Capture happens only on sites a person switches on in the Tacet Chrome extension (a per-site permission), or in Tacet's own demo desk.
Captured
- Field names and labels.
- Safe values only: numbers, dates, dropdown and radio choices, checkboxes, short codes, and short read-only labels the page displays (up to four words, such as a payee or client name).
- Which buttons and actions were used.
- Page URL and title.
- Spoken or typed answers the expert gives to Tacet's questions.
Never captured
- Passwords or hidden fields.
- Any value that looks like a payment card, IBAN or email address (filtered in the page before sending).
- Text people type: only the length is sent.
- Keystrokes, clipboard, other tabs, or sites that are not switched on.
Optional
- Screen replays stay in browser memory.
- “Cloud vision” sends screenshots to Tacet and its AI vision provider, with detected personal-data regions blurred. It is optional.
How data is protected
In transit
All traffic uses TLS.
At rest
Answers, quotes, case facts, Work Maps, session state and certification records are encrypted with AES-256-GCM using a separate key per workspace. Each workspace key is stored only in wrapped form, under a master key kept outside the database. Deleting a workspace destroys its key, so its data cannot be read again, including from backups. The database is Postgres on Railway, US West region.
Isolation
Every record belongs to one organisation (workspace). Every request is authenticated, by sign-in or by a workspace key. Another workspace's data is indistinguishable from data that does not exist. This is tested automatically on every endpoint.
Scrubbing
Before storage and before any AI call, the server removes IBANs, payment cards, emails, phone numbers, tax ids and secret-bearing URLs from answers and captured events.
Abuse limits
Per-workspace and per-demo daily limits apply to AI usage.
Access and sign-in
- People sign in with a one-time 6-digit code sent by email. The code is valid for 10 minutes and allows 5 attempts.
- Session tokens expire after 30 days and can be signed out.
- Machines (the extension, agents) use workspace keys. A key is shown once, stored only as a SHA-256 hash, and can be revoked.
- Teammates join by invitation, are told whose workspace they are joining, and can leave it.
AI providers and training
Tacet uses the Anthropic and OpenAI APIs for language and vision, and ElevenLabs for voice if voice is used. Their API terms exclude using API data to train their models. Tacet does not train models on customer data. Inputs are scrubbed as described above before they are sent.
Sub-processors
| Provider | Purpose | Data involved |
|---|---|---|
| Railway | Hosting, database (Postgres, US West), file storage | Customer content, account emails |
| Anthropic | AI language and vision processing | Scrubbed answers and events; screenshots only if cloud vision is on (personal-data regions blurred) |
| OpenAI | AI language and vision processing | Same as above |
| ElevenLabs | Voice (only if voice is used) | Spoken audio and transcribed text |
| Resend | Sign-in emails | Email address, one-time code |
Your controls
- Export: any member can download all workspace data as JSON, in the app.
- Delete: any member can delete the workspace in the app. Its key is destroyed. A person can also delete their own account; the workspace's data stays with the workspace.
- Off the record: pauses capture at any time.
- Revoke keys: workspace keys can be revoked; sessions can be signed out.
- Demo sandboxes (“Try the demo”, no sign-in) are private to the visitor and deleted automatically 48 hours after they start.
Status of certifications
No third-party certification is held today. Planned, not yet available: SOC 2 Type I, single sign-on (SSO), customer-managed encryption keys, and data residency choices. A data processing agreement (DPA) is available on request: write to shubhamjoshipro.mail@gmail.com.
Report a vulnerability
Email shubhamjoshipro.mail@gmail.com with steps to reproduce. Please do not access data that is not yours, and give us reasonable time to fix the issue before disclosing it. For privacy questions, see the privacy notice.