Security

Security at Tapd

Last updated October 26, 2026

Tapd will help decide how people pay, so security isn't a feature we add later. This page sets out the principles we're building to and how to report a security issue.

The Tapd app is still in development. We'll publish more detail, including the app's own privacy policy, before the private beta opens.

Our principles

• Collect the minimum. We collect only the data needed to pick the best card for each purchase, and nothing for advertising.
• Never sell personal data. Not to advertisers, data brokers or anyone else.
• Encrypt everything. Data is encrypted in transit and at rest.
• Limit access. Only the people who need access to production systems get it, and that access is logged and reviewed.
• Get checked independently. Before Tapd handles live card data, we'll complete the security assessments the payments industry requires, including PCI DSS where it applies.
• Tell people when something goes wrong. If an incident affects you, we'll notify you promptly and explain what happened and what we're doing about it.

This website

• tapdtechnologies.com is served over HTTPS only.
• We don't use advertising trackers or cookies. Our visit statistics are cookieless and reported in aggregate.
• Messages sent through our contact form are delivered to our company email and used only to reply. See our privacy policy.

Reporting a vulnerability

If you believe you've found a security issue in anything Tapd runs, please email security@tapdtechnologies.com with a description of the issue, the steps to reproduce it and the impact you think it has.

We'll acknowledge your report within three business days, keep you updated while we investigate, and credit you publicly once it's fixed if you'd like.

In scope

• tapdtechnologies.com and its subdomains.

Out of scope

• Denial-of-service testing, spam, social engineering and physical attacks.
• Services run by other companies, such as our hosting and email providers. Please report those to the company that runs them.
• Automated scanner output without a demonstrated impact.

Safe harbor

We won't take legal action against good-faith research that follows this policy. Please don't access or change other people's data beyond what's needed to show the issue, don't degrade our services, and give us a reasonable chance to fix the problem before you disclose it. We don't run a paid bug bounty at this time.

Machine-readable contact: /.well-known/security.txt