Security and data control
Where your data lives, how the product protects it, and how to report a problem.
Your data stays on your server
Tagaris is self-hosted. The register lives in your own PostgreSQL database on hardware you control, and the app makes no third-party calls by default: no telemetry, no automatic update check, no analytics. Licence keys are verified offline apart from the activation and renewal checks described in Licensing, and air-gapped installs can use a licence file with no internet at all.
Nothing is locked in. Full CSV and JSON export is available on every tier, and a whole-organisation export is built into Settings.
Access and authentication
Sign-in is email and password with optional two-factor authentication (an authenticator app, an emailed code, or backup codes), included on the free tier. The Team licence adds OpenID Connect single sign-on with Microsoft Entra ID and a policy that requires it for everyone except the break-glass owner account. Roles (Admin, Editor, Viewer) are enforced by a central least-privilege check on the server, and the sign-in endpoints are rate limited.
Secrets and backups
Integration and mail credentials are encrypted at rest with AES-256-GCM, keyed from the install secret. Scheduled backups are built into the product, with optional passphrase encryption, an in-app restore, and offsite copies to S3-compatible storage. The backups guide covers schedules, retention and restore tests.
The software supply chain
Release images are built for linux/amd64 and linux/arm64 with provenance and SBOM attestations, and scanned with Docker Scout. Dependency advisories are tracked and updated on a regular cadence. The deployment files are public at github.com/goodhall-solutions-ltd/tagaris.
Reporting a vulnerability
Email security@goodhallsolutions.co.uk with what you found, how to reproduce it and the impact you think it has. We aim to acknowledge within 3 working days and ask for reasonable time to fix before public disclosure. Please do not raise security issues in the public tracker.
Running it safely
- Set a strong, unique install secret and store a copy safely
- Serve the app over HTTPS behind a reverse proxy that terminates TLS
- Keep the container image current; migrations run automatically
- Take the built-in backups, and test a restore while the stakes are low
- Keep the database unreachable from outside the Compose network, which is the default
Questions a security review will ask
The documentation covers deployment, upgrades, backups and the API in detail, and we answer security questionnaires by email.