Security at TillDev

Our commitments

• We never look at your raw event data outside an investigation initiated by you.
• We never train AI models on your event data. AI features (Ask Pulse and TillMind) call out per-request to a routed inference provider with zero retention beyond the response — see DPA Annex II for the current provider.
• We separate concerns by region. Pin a project to a data region and its events stay there.
• We disclose breaches affecting your data without undue delay, and never later than 72 hours after we become aware, in line with applicable law.

Identity & access

• Passwords hashed with a modern, salted algorithm — never stored in plaintext.
• Short-lived, signed access tokens. Refresh tokens are single-use, rotate on every use, expire, and are stored hashed — never in plaintext.
• Optional two-factor authentication. Secrets are encrypted at rest and backup codes are stored hashed.
• Optional OIDC SSO with PKCE and JIT user creation gated on an allowed-email-domain list.
• Role-based access: owner > admin > developer > viewer.
• Per-user personal API keys, scopable, revocable instantly.
• Audit log of all privileged actions, retained 365 days.

Encryption

• TLS 1.2+ for all client-server traffic. HSTS enforced on app domains.
• Sensitive secrets — two-factor secrets, SSO credentials, and integration tokens — are encrypted at rest.
• Database encryption at rest provided by our managed data platforms.

Privacy by design

• PII is scrubbed twice — in the SDK before transmission, and again at ingest before storage — covering common sensitive data such as emails, phone numbers, payment card numbers, government IDs, mobile-money references, and auth tokens.
• End-user IP addresses are stripped at ingest. The dashboard only ever sees aggregated geo (country, city).
• Configurable beforeSend hook on the SDK lets you drop or redact events before they leave the device.

Network & infrastructure

• Cloudflare WAF and DDoS protection in front of the dashboard and ingest API.
• Rate limiting per project and per IP to protect the ingest API from abuse.
• Inbound webhooks are cryptographically signature-verified and replay-protected.

Operations

• Least-privilege access for engineers. Production access gated by SSO + hardware key.
• Background-checked staff. Onboarding security training. Annual review.
• Backups daily, restored quarterly to validate.
• Incident response runbook with named roles and a recurring drill cadence.

Sub-processors

TillDev uses a small set of vetted sub-processors. The full list with location and purpose lives in Annex II of the DPA. We provide 30 days’ notice before adding a sub-processor.

Compliance posture

We design to support GDPR, POPIA, and Nigeria’s NDPA. We are happy to complete vendor security questionnaires for enterprise customers — email security@tilldev.dev with the questionnaire and your timeline.

Vulnerability disclosure

Security researchers are welcome. Please:

• Email security@tilldev.dev with details and reproduction steps.
• Avoid actions that affect other customers (no DoS, no spamming, no data exfiltration beyond what’s necessary to demonstrate the issue).
• Give us a reasonable window to remediate before public disclosure.

We respond within one business day, prioritise validated issues, and credit researchers who request acknowledgement. We do not currently run a paid bounty program, but we send swag and write thank-you notes.

Out of scope

• Findings that require physical access, social engineering, or compromise of a customer’s own infrastructure.
• Reports that consist solely of the output of automated scanners with no impact analysis.
• Self-inflicted issues — e.g. a customer who configures sendDefaultPii: true and is surprised that PII is sent.
• Missing security headers without an exploitation path (we’ll fix them — they’re not bugs to disclose).