Security & Trust
Built for accountability from day one.
Federal-adjacent customers are in our pipeline from the start. The architecture is designed for CMMC L1 at launch, L2-ready structure, and a clear path to SOC 2 Type 2.
Identity & access control
Short-lived JWTs, role-based permissions scoped to org, project, and cost account. Row-level security at the database — misconfigured app code cannot return another tenant's data.
Data encrypted everywhere
Encrypted at rest on AWS RDS, encrypted in transit with TLS 1.2+. S3 files server-side encrypted. No PHI or financial account credentials stored.
AWS-native infrastructure
Hosted in AWS us-west-2 (Oregon). Private subnets for the database with no public endpoint. CloudFront with OAC — no direct public S3 access.
CMMC Level 1 at launch
Architecture designed for federal-adjacent customers from day one. CMMC L1 self-attest at launch. L2-ready structure. SOC 2 Type 2 on the Phase 2/3 roadmap.
Ready for federal-adjacent work.
Construction firms working on federal or defense-adjacent contracts need a controls platform they can stand behind. Taqql is designed to meet that bar — not retrofit to it after the fact.
Common questions
Things customers ask about security.
Where is my data stored?
AWS us-west-2 (Oregon). The database runs on RDS PostgreSQL in a private subnet with no public endpoint. Files are stored in S3, accessible only through CloudFront with signed requests.
Who can see my organization's data?
Only users you have added to your org, with the roles you assign. Row-level security enforces tenant isolation at the database layer — not just in application code.
Does Taqql store payroll credentials?
No. The Gusto® integration uses OAuth tokens scoped to payroll export only. No credentials are stored.
What AI models process my data?
Amazon Bedrock (Claude model family) powers on-platform AI. Your data is not used to train foundation models. See our Subprocessors page for a full list.
How is voice data handled?
Voice is transcribed immediately. Transcripts are stored and attributed to the cost account. Raw audio is not retained after confirmation.
Does the mobile app work without internet?
Yes. All field-capture flows — timesheets, expenses, daily reports — work fully offline. Data is stored on-device and synced automatically when connectivity returns.
Questions about our security posture?
Email hello@taqql.io — or request Beta access and we'll walk you through the details.
Request Beta Access