Security at Tagsmith

Last updated: July 3, 2026 · Questions: security@gettagsmith.com

Tagsmith governs the UTM links your team ships — so keeping your workspace data safe and available is core to the product. This page summarizes how we protect it. It describes our current practices and is not itself a contract; Enterprise customers receive specific commitments in a signed agreement and DPA.

Data protection

Encryption in transit

All traffic is served over HTTPS/TLS. Database connections use SSL.

Password hashing

Passwords are hashed with bcrypt. We never store or log plaintext passwords.

Token-based auth

Sessions use signed, httpOnly cookies; the browser extension uses revocable bearer API tokens you can rotate at any time.

Tenant isolation

Every workspace's spec, links and members are scoped to that workspace and access-checked on every request by role.

Application security

Server-side enforcement of governance rules — clients can't bypass the spec.
Role-based access control (admin vs. operator) on all workspace and member actions.
Security headers (HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Content-Security-Policy).
Rate limiting on authentication and other sensitive endpoints to slow abuse.
Input validation and payload-size limits on API requests.
Outbound notification webhooks are restricted to public hosts to prevent server-side request forgery.

Infrastructure & sub-processors

Tagsmith runs on managed cloud infrastructure with a managed Postgres database. Our current sub-processors are Render (application hosting and database), Stripe (payment processing), and Twilio SendGrid (transactional email). Payment card data is handled entirely by Stripe; we never see or store full card numbers.

Your controls

Data export: admins can export the full workspace (spec, links, members, history) at any time.
Deletion: workspace owners can delete the workspace and its data from active systems.
Token rotation: API tokens for the extension can be regenerated instantly.
Access management: invite, role-change, and remove teammates; all changes are logged in an audit trail.

Enterprise

The Enterprise plan adds SSO / SAML / SCIM, a signed Data Processing Agreement (DPA), data-residency options, a security review, and an SLA. To start a security review or request our documentation, email security@gettagsmith.com.

Reporting a vulnerability

We welcome responsible disclosure. If you believe you've found a security issue, please email security@gettagsmith.com with details and steps to reproduce. Please don't publicly disclose until we've had a reasonable chance to remediate.

This page reflects our security practices as of the date above and may evolve as the product matures. It doesn't create warranties or contractual commitments except where incorporated into a signed agreement.