Taop Cybersecurity Policy

Effective date: October 17, 2026
Version: 1.0.0
Applies to: All individuals, freelancers, agencies, and enterprises accessing or utilizing the Taop platform, APIs, Model Context Protocol (MCP) connectors, and client portals worldwide.

1. Overview & Scope

This Cybersecurity Policy outlines the security architecture, risk management controls, subprocessor transparency, and customer responsibilities governing the Taop application. Taop is engineered and operated by B C DE SOUSA CODESIGNERS, registered in Brazil under CNPJ no. 18.848.888/0001-82 ("Taop", "we", "us", "our"), with principal offices at RUA 137, 556, sala 101, Goiânia-GO, CEP 74.170-120, Brazil. Contact: hello@taop.io / security@taop.io.

This policy applies to all systems, software, databases, AI integration pipelines, and remote MCP endpoints operated under the taop.io domain and associated mobile or web interfaces.

2. Current Security Posture & Certification Status (Honest Appraisal)

Taop is committed to full transparency regarding our independent audit and certification standing:

No SOC 2 Certification (Current Status): Taop does not currently hold a SOC 2 (Type I or Type II) certification, ISO/IEC 27001 certification, or equivalent formal third-party security audit attestation.
Security-by-Design Implementation: While we have not engaged an external auditing firm for formal SOC 2 certification at this stage of our product maturity, our architecture incorporates defense-in-depth security controls, including modern transport layer encryption (TLS 1.3), automated database isolation, least-privilege credential management, and edge-level denial-of-service protection.
Enterprise Procurement Evaluation: Organizations requiring certified SOC 2 Type II reports or external audit attestations prior to software adoption must evaluate this policy to determine whether our current security posture satisfies their internal compliance frameworks.

3. Artificial Intelligence Request Cascade & Data Retention Reality

Taop integrates generative artificial intelligence to power estimate template generation, dynamic pricing assistance, proposal styling, and contract drafting. We disclose our AI architecture openly:

3.1 Lack of Zero Data Retention (ZDR) Agreements

Taop does not have custom Zero Data Retention (ZDR) agreements executed with its third-party artificial intelligence model providers. All AI requests processed through Taop operate under standard enterprise/commercial API terms. Under these commercial API agreements:

AI providers maintain operational and security logs.
Providers may retain, inspect, and temporarily store prompt payloads, system instructions, and completion responses for abuse monitoring, safety filtering, and system diagnostics for periods typically ranging from 0 to 30 days in accordance with their respective terms of service.
Although standard commercial API terms generally stipulate that customer API data is not used to train public foundation models, Taop cannot independently audit, verify, or guarantee third-party internal server retention practices.

3.2 AI Provider Request Chain (Primary & Fallback Cascade)

To ensure system resilience and high availability, Taop utilizes a sequential AI Model Cascade. If a primary model experiences transient network failures, rate limiting, context window limitations, or billing quota depletion, the request automatically fails over to the next configured provider in the cascade.

Our AI request chain includes the following providers and model families:

Primary Provider:
- Google Cloud / Google AI: Gemini family (e.g., gemini-3.1-flash-lite-preview, gemini-3.5-flash, gemini-2.5-flash).
Fallback Providers (Sequential Automatic Failover Chain):
- Alibaba Cloud: Qwen series (e.g., qwen3.7-plus).
- MiniMax: MiniMax multimodal series (e.g., MiniMax-M3).
- Moonshot AI / Kimi: Kimi code and reasoning series (e.g., kimi-k2.7-code).
- Zhipu AI / Z-AI: GLM series (e.g., glm-5.2).
- DeepSeek: DeepSeek chat and reasoning models (e.g., deepseek-chat, deepseek-v4-flash).
- OpenAI: GPT model family (e.g., GPT-5.1-Codex-Mini, gpt-3.5-turbo).
- Anthropic: Claude model family (e.g., claude-3-haiku-20240307).

3.3 Data Minimization During AI Invocations

When transmitting requests to our AI providers, Taop limits the payload to the prompt text, specific project scope parameters, and transient design reference images required to satisfy your immediate query. Taop does not transmit your complete client directory, historical billing records, or unrelated contract databases to AI providers.

4. Handling of Contracts Data, Estimates & Uploaded Documents

4.1 Database Storage & Multi-Tenant Isolation

Neon Serverless PostgreSQL: All application metadata, brand guidelines, estimates, and contract terms are persisted in PostgreSQL databases hosted in United States data centers via Neon.
Encryption Standards: Data is encrypted at rest using AES-256 and encrypted in transit using TLS 1.3 over secure HTTPS connections.
Tenant Isolation: All database queries enforce strict user-level partitioning (userId). Cross-tenant access is programmatically blocked at the ORM layer.

4.2 Document & File Storage (AWS S3)

Object Storage: Uploaded files, generated contract PDFs, client brand assets, and reference images are hosted on Amazon Web Services (AWS S3).
Server-Side Encryption: Buckets utilize AWS S3 server-side encryption (SSE-S3).
Private Access Control: S3 buckets are strictly private and inaccessible to the public web. File access is mediated exclusively through time-limited pre-signed URLs generated on demand for authenticated users or validated client portal recipients.

4.3 Contract Signing & Audit Trail

When contracts are executed through Taop:

Signer timestamps, IP addresses, and user-agent strings are immutably recorded in contract audit logs to support legal enforceability under applicable electronic signature laws (including LGPD Art. 10, E-SIGN Act, UETA, and eIDAS).
Signed documents receive a tamper-evident digital verification token and QR code enabling counterparty document authenticity verification without exposing sensitive internal account metadata.

5. Model Context Protocol (MCP) Security Architecture

Taop exposes a remote Model Context Protocol (MCP) server allowing users to connect external autonomous AI agents (such as Claude Desktop, OpenAI Assistants, or Gemini Workflows) directly to their account:

Authentication via Personal Access Tokens (PATs): External agents must authenticate using cryptographically random Personal Access Tokens (taop_mcp_live_...). Tokens are hashed with SHA-256 prior to storage; plaintext tokens are never retrievable after initial generation.
Granular Scopes: Token permissions are strictly restricted to explicit scopes (read:profile, read:brands, read:templates, read:contracts, read:pricing, write:templates:draft, write:brands:notes, write:contracts:draft).
Human-in-the-Loop (HITL) Gate: Tier 2 mutations (such as updating live published templates or archiving brand profiles) cannot be performed autonomously by external agents. The server halts execution, logs a pending action, and generates a secure one-click human confirmation URL. The mutation executes only after explicit human approval.
Automated PII Masking Pipeline: All outgoing tool payloads pass through a recursive PII sanitizer that masks Brazilian CPFs, CNPJs, Canadian SINs, and credit card numbers prior to transmission to the external agent host.
Denial-of-Service Clamping: Tool output strings are capped at 32 KB per field to defend against context flooding and buffer exhaustion.

6. User Acknowledgement, Data Responsibility & Disclaimer of Liability

PLEASE READ THIS SECTION CAREFULLY. IT GOVERNS YOUR LEGAL RESPONSIBILITIES AND ALLOCATES CYBERSECURITY RISK.

6.1 Sole User Responsibility Over Uploaded Data

You, as the user, customer, or account owner, acknowledge and agree that:

You maintain sole and exclusive responsibility for assessing the classification, confidentiality, and sensitivity of all text, documents, commercial secrets, pricing formulas, personal data, and client files you upload or input into Taop.
You warrant that you possess all necessary legal permissions, consents, and intellectual property licenses from your clients, counterparties, and data subjects prior to entering their information into Taop or subjecting their data to generative AI features.
You are solely responsible for reviewing and verifying the accuracy, completeness, and legal compliance of any contract, estimate, or proposal draft produced by our AI features before delivering or executing it with third parties.

6.2 Zero Accountability Regarding Third-Party AI Data Handling

Taop and B C DE SOUSA CODESIGNERS explicitly disclaim any accountability, liability, warranty, or representation concerning how third-party AI model providers (including Google, Alibaba Cloud, MiniMax, Moonshot AI, Zhipu AI, DeepSeek, OpenAI, Anthropic, or their affiliates) read, inspect, log, cache, or retain the data transmitted to them via our AI request chains.

By utilizing AI-assisted features in Taop, you explicitly acknowledge that:

Your inputs and reference materials will be processed by external third-party server infrastructures.
Third-party AI vendors may retain logs for abuse prevention and diagnostic purposes under their standard terms.
Taop shall not be liable for any data breach, unauthorized access, data retention violation, intellectual property disclosure, or regulatory fine resulting from the actions, omissions, logging practices, or security failures of third-party AI model providers.

6.3 Prohibited High-Risk Data

You agree NEVER to submit, upload, or process through Taop or its AI features:

Government-classified or national defense information.
Unmasked payment card data (PCI-DSS PANs, CVVs, or magnetic stripe data).
Protected Health Information (PHI) subject to HIPAA or equivalent healthcare privacy statutes.
Unredacted biometric identifiers or genetic data.
Controlled export technical data under ITAR or equivalent export control regimes.

7. Infrastructure & Application Security Controls

Taop employs modern application security controls across our software development lifecycle:

Identity & Authentication: User identity, password hashing, and session tokens are secured via Clerk, featuring multi-factor authentication (MFA) capabilities, rate limiting, and brute-force protection.
Edge Security & DDoS Mitigation: Ingress traffic passes through Cloudflare edge proxy networks providing Web Application Firewall (WAF) filtering, automated bot inspection, and volumetric DDoS mitigation.
Continuous Secret Scanning: Application repositories are protected with automated secret detection to prevent credential or API key leakage in version control.
Access Controls & Least Privilege: Production database and cloud infrastructure access is restricted to authorized engineering personnel using multi-factor authentication and role-based permissions.

8. Incident Response & Responsible Vulnerability Disclosure

8.1 Security Incident Management

In the event of a confirmed security incident impacting customer data:

Taop will initiate our internal incident response procedure to contain, investigate, and remediate the vulnerability.
In compliance with applicable privacy laws (including LGPD Art. 48 and GDPR Art. 33/34), we will notify affected users and appropriate supervisory authorities without undue delay where required by law.

8.2 Vulnerability Disclosure / Safe Harbor

We welcome responsible security research from our community:

If you believe you have discovered a vulnerability in Taop, please report it immediately to security@taop.io or hello@taop.io.
Please include detailed steps to reproduce the vulnerability.
We commit to acknowledging receipt of your vulnerability report within 48 business hours.
We request that you provide a reasonable coordinated disclosure window (at least 30 days) before publicly disclosing any finding.
Taop will not pursue legal action against security researchers who conduct good-faith security research in compliance with this responsible disclosure policy.

9. Policy Versioning & Tracking

This policy is maintained in our centralized legal repository and tracked through automated version control. Significant changes to this policy, subprocessor chains, or security controls will be reflected in the "Version" and "Effective date" headers above, accompanied by in-product or email notifications where required.

10. Contact Information

For questions, vulnerability disclosures, or security inquiries regarding this Cybersecurity Policy:

B C DE SOUSA CODESIGNERS
CNPJ: 18.848.888/0001-82
RUA 137, 556, sala 101, Goiânia-GO, CEP 74.170-120, Brazil
Email: hello@taop.io / security@taop.io