Trust, security & legal

TapPass sits between your AI agents and the AI models and tools they use. It checks every request against your organisation's rules before anything happens, and decides in real time whether to allow it, block it, or adjust it. It automatically screens each request for sensitive information such as personal data and secrets. If your rules cannot be loaded, the request is blocked — nothing passes through unchecked.

There are two ways TapPass runs. In one, TapPass only returns the decision and your own systems talk to the AI model, so TapPass never sees the content. In the other, TapPass passes the approved request to the AI model on your behalf — using your own account with that provider — and checks the answer before it is returned.

While checking a request, TapPass reads the request itself — the text of the prompt, any action the agent wants to take, and which AI model is involved. The screening for sensitive information happens in memory and is not stored as text.

What TapPass keeps afterwards is, first and foremost, a record of the decision: what was allowed or blocked and why, which model was used, the cost, and which agent, user and organisation were involved, with the date and time.

TapPass also keeps a copy of the request and the response so your team can review what your agents did. You control this: it can be switched off so that only the decision record is kept, and no request or response content is stored.

Your data is stored in a secure database in the European Union — in Belgium — with encrypted backups. TapPass keeps a trustworthy record of every decision so you can always show what your agents did; that record is the heart of the product.

You decide how long records are kept. When a record reaches the end of that period, TapPass deletes it completely — including any stored request and response content, not only the short summary.

Records are kept for as long as they are useful for audit, rather than thrown away after each request — that is what lets you prove what your agents did. They are removed in two ways: automatically, when they reach the end of the retention period you set; and on request, when someone exercises their right to be forgotten.

An erasure request removes that person's information across the platform, including the full text of their requests and responses, while keeping the audit trail verifiable. Backups clear themselves on their normal cycle.

Your data is kept strictly separate from every other customer's. This is enforced in two independent ways, so no one outside your organisation can see it.

Inside your organisation, what someone sees depends on their role: everyone can see summaries, and administrators can see the detail. People sign in with your single sign-on or a password.

TapPass staff cannot change your data. In rare support situations, a TapPass administrator can open a view of your workspace that is strictly read-only, limited to your organisation, and lasts at most 30 minutes. Every such view is written to the same tamper-proof record — so we can always show you exactly when your workspace was viewed, and by whom.

Every decision is written to a tamper-proof record. Each entry is sealed and linked to the one before it and cryptographically signed, so any change or missing entry is immediately detectable.

Everyday system logs contain only technical identifiers — never the content of prompts and never personal data.

You can also send your own audit records to your security monitoring system. This is switched off unless you turn it on, and sensitive fields are removed before anything leaves TapPass.

TapPass itself — its servers, its database and its records — runs in the European Union, and your organisation is set to the EU region by default.

The only point where information can leave the EU is the AI model itself, and only if you choose a model hosted outside the EU. That choice is entirely yours: European or self-hosted models keep everything in the EU. When you require it, TapPass enforces EU-only models automatically, and we set this up for European customers.

Two things to be clear about: our built-in assistant uses a US-based model and can be turned off; and every outside company that helps run TapPass is listed, with its location, in the Subprocessors section above.