Clear boundaries.
Straight answers.

Start with your deployment.

Data handling and operational responsibilities depend on the deployment and services you use. Review the current product and deployment options, then discuss your requirements with us.

For an evaluation, tell us what you need to establish: where traffic is processed, who can access it, what evidence is retained, and how changes are reviewed. We will complete a reasonable security questionnaire for a serious evaluation.

Current status

Certifications

We do not hold a SOC 2 report, an ISO 27001 certificate, or any other third-party security certification. No such audit has been performed. If your procurement process requires a certification, tell us what you need before starting an evaluation.

Product controls and release evidence can support your operational review. They are not a substitute for an independent security audit.

Data and agreements

TokenTriage is provided by INFEROPS LLC. Our privacy policy describes this website’s data handling. The subprocessor register identifies the services involved, and the data-requests page explains how to contact us about your information.

Website terms, software licensing, and a hosted service agreement cover different things. Hosted processing belongs in the applicable service agreement and privacy notice. The website terms describe that separation; this page does not replace those documents.

For the agreements and processing terms relevant to your evaluation, contact [email protected]. A standalone signable DPA is not offered today.

Availability commitments

We publish no service-level agreement and no availability figure on this site. This page makes no uptime, recovery-time, or recovery-point commitment.

Discuss your operational requirements during evaluation and review the applicable agreement before relying on a service commitment.

Responsible disclosure

Reporting a vulnerability

Send it to [email protected]. Include enough detail to reproduce it — a proof of concept, affected version or URL, and the impact you think it has. If you would like to encrypt the report, say so in a first message and we will arrange it.

What to expect. A human acknowledgement, then an assessment and a fix if the report is valid. We do not run a bug bounty and we cannot offer a payment. We are a small team and we are not going to publish a response-time commitment we have no process to guarantee — what we will do is answer you, and tell you honestly where the report stands.

Safe harbour. If you make a good-faith effort to comply with this section, we will not pursue or support legal action against you for your research. That means: only test against systems you own or have permission to test, do not access, modify or delete data belonging to anyone else, do not degrade the service for others, stop as soon as you have demonstrated the issue, and give us a reasonable opportunity to fix it before disclosing it publicly. This is our commitment not to sue you; it cannot bind any third party, including the providers named on our subprocessors page.

The same address is published in machine-readable form at /.well-known/security.txt (RFC 9116), so a scanner or an automated disclosure workflow finds it without parsing this page. That file carries an Expires date and is worse than useless once past it — if you are reading a stale one, the address on this page is the authority.

Bugs that are not security issues can go to [email protected] too.