Security
Tahana holds your family calendar, your budget, your health log, and your conversations with each other. Here is exactly where that lives, who can reach it, and what we do to keep it safe.
Last updated: August 21, 2026
The database keeps households apart
Every table in Tahana is protected by PostgreSQL Row Level Security, scoped to your household. Your rows are bound to your household at the database layer, so the database refuses to hand them to anyone outside it. That protection holds even if our own application code asks for the wrong thing.
Two-step verification on your account
You can turn on app-based two-step verification from your account settings, and once it is on, it is enforced everywhere: the web app, the mobile app, and our own API. A stolen password on its own is not enough to reach your household.
Your card never touches our servers
Subscription billing is handled end to end by Stripe, a PCI DSS Level 1 Service Provider, the highest level of payment security certification. We receive confirmation of payment, the last four digits, and your billing country. Never the full card number, the CVV, or your bank details.
The infrastructure we build on
Tahana is a small, independent Canadian company, and we made a deliberate choice not to run our own servers. Instead we build on providers whose security is independently audited every year by third-party firms. The certifications below are held by those providers, and each one is verifiable on their own trust page.
| Provider | What they do for Tahana | Their certifications |
|---|---|---|
| Stripe, Inc. | Subscription payments and billing | PCI DSS Level 1 Service Provider |
| Vercel, Inc. | Application hosting, TLS, and DDoS mitigation | SOC 2 Type II, ISO 27001 |
| Supabase, Inc. | Database, authentication, and file storage, running on Amazon Web Services | SOC 2 Type II, HIPAA capable |
| Amazon Web Services | Underlying cloud and physical datacentre infrastructure | SOC 1, SOC 2, SOC 3, ISO 27001, ISO 27017, ISO 27018 |
| Resend, Inc. | Invitation, notification, and support email | SOC 2 Type II |
| Twilio, Inc. | Optional SMS reminders | SOC 2 Type II, ISO 27001 |
| Google Firebase | Push notifications to the Tahana mobile app | SOC 1, SOC 2, SOC 3, ISO 27001, ISO 27017, ISO 27018 |
| Anthropic PBC | AI assistant, receipt scanning, and food-photo logging | SOC 2 Type II |
| GitHub, Inc. | Source code management for the Tahana codebase | SOC 2 Type II, ISO 27001 |
To be clear about what these certifications mean: they are held by the providers named above, not by Tahana. They cover the platforms our software runs on. How we configure and operate Tahana on top of those platforms is our own responsibility, and that is what the next section describes.
How we operate
These are the controls we run ourselves, aligned to the ISO/IEC 27001 Annex A control set.
Multi-factor authentication on our side too
Every account that can reach Tahana production systems, including our hosting, database, payments, email, and source control, is protected by multi-factor authentication.
Least privilege on production credentials
Privileged database keys are held only by the company director, are never exposed to the browser, and live exclusively in server-side environment variables scoped to production.
Encryption everywhere
All traffic to Tahana runs over HTTPS with TLS. Data at rest is encrypted with AES-256 by our database provider. Passwords are never stored, only a one-way hash we cannot reverse.
Admin tools that cannot read your household
Our internal admin panel shows account, subscription, and usage information only. It has no ability to open your messages, health entries, budget, documents, or photos.
Backups
Our database provider takes automated daily backups so your household's data can be recovered after an incident. Deleted data may persist in those encrypted backups for up to 90 days before it is overwritten.
Change management
All changes to Tahana are version controlled, reviewed before release, and deployed through an automated pipeline. Every release is traceable to the change that produced it.
Where we are on independent certification
We would rather be straight with you than hide behind our providers' badges. Tahana itself is not yet independently certified to ISO/IEC 27001 or SOC 2. We follow controls aligned to those standards, and we will update this page the moment that changes. Any company that tells you it is “SOC 2 certified” because its hosting provider is has not told you the whole story.
The parts of Tahana that need extra care
A household app holds things a to-do list never would. These four get specific treatment.
Health data
Medications, cycle data, symptoms, sleep and weight logs are treated as a special category of data. They are visible only to you unless you deliberately share a health module with someone in your household, and they are never used for advertising or model training.
Household messages
Messages between household members are stored in your household's own rows and are subject to the same Row Level Security as everything else. We do not read them, and our admin tools cannot open them.
Documents and the Vault
Files you upload live in access-controlled storage where the first path segment is checked against your own account on every request. A signed-out link cannot walk into another household's folder.
What the AI sees
The AI assistant only receives the message you type and the household data needed to answer it. Receipt images and food photos are sent for processing and then discarded. Anthropic does not train its models on this data.
What we never do
- Sell, rent, or trade your personal, health, or financial information
- Show advertising, or share your household data with any ad network
- Use your household data to train AI models
- Install advertising trackers, pixels, or fingerprinting scripts
- Store your full card number anywhere in our systems
- Read your messages, health entries, budget, or files for any purpose other than showing them back to you
Our only revenue is your subscription. That is deliberate. It means the way we make money never depends on doing something with your household's data that you would not want.
What you control
Two-step verification. Turn it on in your account settings. It is the single most effective thing you can do to protect your household, and it takes about a minute.
Who sees what. Sharing in Tahana is per module, not all or nothing. Health, budget, and private notes stay yours unless you choose to share them, and access you were granted by someone else cannot be passed on by you to a third person.
Export and delete. You can export your household data at any time from Preferences. To have your account and everything in it permanently erased, write to us at support@herolabsdigital.com and we will action it. Erasure is not a hidden archive, subject only to the backup window described above.
Reporting a security problem
If you believe you have found a vulnerability in Tahana, please tell us before telling anyone else. We read every report, we do not take legal action against researchers acting in good faith, and we will keep you updated on the fix.
support@herolabsdigital.comWe aim to acknowledge every security report within 72 hours. Please include the steps to reproduce the issue, and please do not access, modify, or delete data belonging to any household other than your own while testing.