1. Secure connection (SSL/TLS)
All traffic to tafric.com is encrypted with an SSL certificate issued by a trusted certificate authority. Only TLS 1.2 and TLS 1.3 are accepted; TLS 1.1 and older protocols are disabled. Plain HTTP requests are redirected to HTTPS and browsers are instructed (HSTS) to always use an encrypted connection.
2. Card payments
Card payments are taken on the bank's or licensed payment institution's secure payment page and verified with 3D Secure (a one-time code sent by your bank). Card number, expiry date and CVV never pass through or get stored on Tafric servers; we only receive the result of the transaction. Card data is processed by the bank under PCI-DSS rules.
3. Account security
Passwords are stored only as one-way hashes (bcrypt) and cannot be read by anyone, including our staff. New accounts are activated by email verification, and sessions are only carried over the encrypted (HTTPS) connection. Never share your password; Tafric staff will never ask for it.
4. Data protection
Access to data is enforced in the database itself: each company can only see its own records, and contact details are shown only within the limits of the member's plan. Uploaded files are checked for type and size and their location metadata (EXIF/GPS) is removed. Backups are encrypted and kept in a separate location.
5. Reporting a security issue
If you notice a security issue or suspicious activity on your account, please write to info@tafric.com. How we process personal data is explained in our Privacy policy.