1. Responsibility and approach
TAPLOOP TECHNOLOGIES INC. operates Taploop. Security controls are intended to keep account access, provider credentials, approvals and spending authority separate from generated instructions. A feature's readiness depends on its implementation and workspace configuration; see current capabilities.
2. Access and credentials
- Authenticated requests are checked against account, role and workspace authority. The public inquiry administration route requires an authorized administrator.
- Production website sessions use secure, HTTP-only cookies. Session tokens and workspace MCP bearer tokens are stored as digests rather than reusable plaintext values.
- Service credentials are handled server-side. Supported stored connection credentials use encryption; passwords and provider tokens should not be placed in chat prompts, public URLs or evidence.
- Workspace tokens are scoped and revocable. Disconnecting or revoking access does not erase historical evidence or guarantee that an already-dispatched external action can be undone.
3. Action and payment boundaries
Supported workflows check the permitted capability, authority and relevant limits. Consequential actions require the approval specified by that workflow. Metered public-web operations require sufficient service credit, and usage is recorded in the ledger. Paid credit is added only after matching server-side payment confirmation.
Unknown provider outcomes remain uncertain until evidence resolves them. An approval, screenshot, callback or provider receipt is not by itself proof of a completed business outcome. These controls do not make every planned integration generally available.
4. Your role
Protect account credentials, keep devices and AI clients secure, grant only necessary permissions and review consequential instructions. Revoke tokens or connections you no longer need. Promptly report suspected account compromise. Share the smallest amount of personal or confidential information needed for a task, and confirm requirements before using sensitive or regulated data.
5. Report a security concern
Email hello@taploop.agency with the affected service, a short description, approximate time and a safe contact method. Do not include live credentials, full customer records or destructive exploit instructions in the first message. We will review the report and arrange a suitable way to exchange necessary detail.
Avoid accessing other people's data, disrupting service or testing outside systems you are authorized to use. A contact route does not itself grant authorization for security testing or promise a bounty or response-time SLA.
6. Assurance and privacy
Taploop does not claim SOC 2 certification, ISO 27001 certification, an independent security audit or universal compliance with a particular regulatory framework on this page. Ask us about any security, processing or contractual requirements before relying on the service for them. Our Privacy policy explains information handling and requests, and the company and policy overview lists related documents.