Tamis

Trust & security

Security and
data handling.

Where your data goes, what is proven, what still needs confirming, and how to report a flaw to us.

Prepare a security review Report a vulnerability

Where your data goes

You choose the boundary.

Hosted SaaS

Available

Your side

  • Git repository

Crosses the boundary: the code, fetched from your repository

Tamis, in the EU

  • Analysis
  • Results

Code is fetched from your source manager and analyzed in your Tamis-hosted instance, in the European Union on OVHcloud or Scaleway.

Self-hosted and air-gapped

Available

Your side

  • Git repository
  • Analysis
  • Results
  • Secrets

Crosses the boundary: updates, as a signed bundle

Tamis, in the EU

  • No customer data

Self-hosted, your data stays with you if you only use local services.
Updates arrive as a signed bundle, verified before import.

SaaS with an agent in your VPC

In development

Your side

  • Git repository
  • Agent and scanners
  • Source code

Crosses the boundary: bounded metadata: rule, path, line

Tamis, in the EU

  • Triage
  • Results

Its transport removes descriptions, remediation text and code snippets; its internal validation is under way.
The title and path it sends can still reveal fragments of the source.

Controls

Every claim has a status.

  • Stated by Tamis described on this page, demonstrated on request
  • To confirm settled in the contract
  • Not claimed no attestation
  • Stated by Tamis

    Encryption

    TLS 1.3 supported in transit (minimum configurable from TLS 1.2), secrets encrypted at rest, connectable secrets vault (Vault, AWS, Azure) and configurable master-key protection.

  • Stated by Tamis

    Audit log

    Numbered log, protected against ordinary changes, with controlled pseudonymisation.

  • Stated by Tamis

    Supply chain

    Signed bundles verified before import, CycloneDX SBOM and cosign verification documented.

  • To confirm

    Availability and recovery

    SLA, RTO and RPO are settled in the contract; they are not published here.

  • To confirm

    Vendor documents

    DPA, subprocessor list and pentest report, shared on request.

  • Not claimed

    Certifications

    Tamis is not ISO 27001 or SOC 2 certified.
    The product organizes the evidence for your audits; it certifies neither Tamis nor your organization.

For your own projects' compliance (ISO 27001, NIS2, DORA, EBIOS RM), see the CISO and GRC page.

A vendor questionnaire?

Send it with your deployment mode.
We answer by separating what is stated here, what is available under agreement and what is not available yet.

Prepare a security review 

Or by email: contact@tamis.app

Responsible disclosure

Report a vulnerability

How
Write to security@tamis.app with the impact and reproduction steps.
PGP key on request.
Timelines
Acknowledgement within 2 business days, triage within 5.
Fix within 7 days for a critical flaw, 30 for high, 90 for medium.
  • Critical7 days
  • High30 days
  • Medium90 days
Scope
tamis.app, the Tamis product and the infrastructure we run.
Out of scope: third-party services, social engineering, denial of service.
Good faith
No legal action if you follow this policy and do not access data that is not yours.
Public disclosure after the fix, by mutual agreement.
Recognition
We publicly acknowledge researchers whose reports are validated, with their consent. We do not offer monetary rewards or complimentary licences.

Machine-readable contact: /.well-known/security.txt.
Policy updated on 11 October 2026.