Defined security ownership
ImplementedTipoff assigns responsibility for access, change management, incident response, vendor risk, business continuity, and ongoing control review.
Security, clearly explained.
A practical overview of how Tipoff protects customer data, separates workspaces, constrains AI-assisted actions, and prepares for incidents.
Search the full public overview
Data protectionTenant isolation, access, encryption, and retentionApplication and AI safetySecure development, human control, and integrationsResilience and responseMonitoring, incidents, continuity, and recovery
Security program and assurance
We describe controls at the level customers need for vendor review. Detailed evidence and sensitive implementation information are shared through an appropriate diligence process.
SOC 2 readiness
In progressOur control program is mapped to the AICPA Trust Services Criteria for Security. Independent examination remains future work, so we do not present internal testing as certification.
Customer due diligence
ImplementedCustomers may contact us for security questionnaires, data-processing terms, and available supporting material. Access to sensitive documents may require confidentiality protections.
Clear assurance boundaries
ImplementedWe review material service providers and identify their role in delivering Tipoff. A provider's compliance report does not certify LinkedOtter LLC or Tipoff.
Tenant isolation and access control
Safeguards operating today protect workspace data through layered identity, application, and database controls.
Workspace boundaries
ImplementedCustomer records are scoped to their workspace. Authenticated requests verify workspace membership and permissions, and tenant data uses database row-level security (RLS) as an additional boundary.
Least privilege
ImplementedAdministrative and member capabilities are separated. Privileged operations are restricted to authorized personnel and scoped to the customer or operational purpose involved.
Verified sessions and single sign-on
ImplementedSensitive requests revalidate the signed-in user. Enterprise customers can request SAML single sign-on with providers such as Okta, subject to configuration review and activation.
Protected in transit and at rest
ImplementedConnections use encrypted transport. Customer data and integration credentials are protected at rest, and stored secret values are not returned to the browser.
Audit evidence
ImplementedSecurity-relevant administrative activity is logged so access and configuration changes can be reviewed and investigated.
Retention and deletion
ImplementedWe limit retention according to the data and service purpose. Workspace deletion is confirmation-gated and audited, and customers can request deletion under applicable terms and law.
Application and AI safety
AI output does not grant authority. Deterministic product controls govern identity, permissions, targets, budgets, and approval.
Secure change process
ImplementedApplication changes are version controlled and pass automated quality and security checks before release. Security-sensitive changes receive additional review and validation.
Untrusted content stays data
ImplementedContent from connected tools, files, web pages, signals, and model output is treated as untrusted input. It cannot replace system policy or create a permission.
Permissions are rechecked
ImplementedSensitive AI-assisted actions are checked against the authenticated user, active workspace, required capability, and action risk before execution.
Consequential actions require review
ImplementedExternal communications and other consequential operations are shown for review and require explicit user action. Approval is bound to the intended recipient and payload.
Scoped connections
ImplementedConnected services are limited to the access needed for the requested feature. Credentials stay server-side, and outbound destinations are validated before use.
Budget and action limits
ImplementedPaid or autonomous operations are constrained by workspace limits and action-specific safeguards before providers are contacted.
How data is used
| Data | Purpose | Service categories involved |
|---|---|---|
| Account and workspace data | Provide, secure, support, and bill for Tipoff | Hosting, database, authentication, support, and payment services |
| Customer lists and CRM records | Match, score, enrich, prioritize, and automate at the customer's direction | Configured enrichment and connected-action services |
| Public and licensed business data | Generate company intelligence and buying signals | Tipoff's processing environment and authorized data suppliers |
| AI feature inputs | Generate analysis or drafts requested by a user | The model service configured for that feature |
Infrastructure and subprocessors
Vercel
ImplementedHosts and serves the Tipoff application. Vercel publishes information about its own security and compliance program.
Supabase
ImplementedProvides managed database and authentication infrastructure. Supabase publishes information about its own security and compliance program.
Naming material infrastructure providers is a normal part of subprocessor transparency. Their certifications apply only to their defined services and audit scope.
Monitoring, incidents, and continuity
Operational and security signals
ImplementedTipoff monitors service health, application failures, scheduled work, and security-relevant administrative activity. Alerts and evidence support investigation and control review.
Incident process
ImplementedOur incident process covers triage, containment, evidence preservation, recovery, customer communication, and lessons learned.
Backup and recovery planning
ImplementedTipoff uses managed infrastructure with backup and recovery capabilities and maintains continuity procedures appropriate to the service.
Material incident notice
ImplementedWhen required, affected customers are notified in accordance with applicable contracts and law, with available information about impact and response.
Shared security responsibilities
Customers should protect identity-provider accounts, use strong authentication, remove departed users promptly, grant only necessary roles, review staged actions before approval, keep connected-service access current, and report suspicious activity. Customers remain responsible for the lawful collection and use of data they provide to Tipoff and for actions they approve.
Report a security issue
Machine-readable disclosure details are available at /.well-known/security.txt.