Security and compliance

Tao Systems signs Business Associate Agreements with US covered entities and their business associates. The BAA covers Tao's access to PHI during installation and support sessions inside your environment; the PHI itself stays in your cloud account or datacentre, under the AWS BAA or the Azure or GCP DPA you already hold. Our BAA template is one of the documents available under NDA.

PHI is encrypted with AES-256 at rest and TLS 1.2 or higher in transit. The audit log records reads as well as writes, which is the detail that matters when a compliance officer asks who looked at a record and when. Minimum-necessary access is enforced through roles and field-level permissions rather than through a policy document: a user without rights to a field doesn't see it in the interface, the API or an export.

HIPAA training is completed annually and a formal risk assessment is carried out each year. If we confirm a breach affecting PHI, the BAA commits us to notifying you within 72 hours.

For analytics, Basin supports de-identification using the Safe Harbor method: the 18 identifiers named in the rule are removed or generalised (dates reduced to the year, ZIP codes truncated to three digits, names and contact details dropped) as a governed pipeline step, so analysts work on de-identified tables while the identified source stays locked down.

Our Data Processing Agreement incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, so one document covers customers in the UK, the EEA and any transfer between them. Residency is under your control: Relay and Basin run in your own cloud account or datacentre, so data stays in whichever UK, EU or US region you pick, or in your own building, and never leaves the compliance boundary you already have. Tao is a processor only during installation, onboarding and support. Support is provided from the UK, so where your data sits in the EU, the cross-border access that a support session involves is covered by the SCCs and the UK Addendum in the same DPA.

Privacy questions, DPIAs, sub-processor queries and correspondence with supervisory authorities go to privacy@taosystems.dev. The sub-processor list is published below, none of it touches product data, and we give 30 days' notice before anything on it changes.

If your deployment needs a Data Protection Impact Assessment, we supply the processor-side input in writing: data flows, retention, security measures and the access model for installation and support sessions. The rest of the assessment is yours, since you're the controller and the software runs on your infrastructure.

Both products have built-in tooling for subject access requests and erasure. Relay exports everything held about a contact and can delete it; Basin's right-to-erasure workflow propagates the deletion across every connected table and produces an evidence record for your auditors. Enquiry data from this website is kept for 24 months; the privacy policy has the detail.

If you find a vulnerability in Relay, Basin or this website, email security@taosystems.dev with enough detail for us to reproduce it: the affected component, the steps, and what you observed. We acknowledge every report within 2 working days and tell you what we found and when the fix will ship.

We follow 90-day coordinated disclosure. We ask you to hold publication for 90 days from your report, or until the fix is released if that's sooner, and we'll agree the date with you. Researchers who report in good faith are credited, by name or handle, if they want to be. We don't run a paid bounty programme.