In short: Tacto is ISO 27001:2022 certified and stores all data encrypted in Microsoft Azure data centers in the EU.
Answer
Tacto operates a SaaS solution for industrial procurement based on the "security by design" principle. Communication with the Tacto portal complies with current industry standards (ISO 27001, SOC 2, BSI recommendations).
Area | Measures |
Infrastructure | Microsoft Azure, regions "Germany West Central" and "West Europe"; data centers certified to ISO/IEC 27001, SOC 2 Type II and TISAX |
Data location | exclusively in the EU, no data transfer to third countries |
Tacto certification | ISO 27001:2022; all subcontractors are also certified |
Transmission | TLS 1.3, SSL certificates from Let's Encrypt |
Malware | automatic malware scan of all uploaded files (Azure Storage Malware Scanning) |
Network | Anti-DDoS protection, web application firewalls (WAF), continuous monitoring |
Storage | AES-256 encryption for databases, backups and file storage; key management via Azure Key Vault with rotation and access control |
Backups | encrypted, redundant in Germany and the Netherlands, 30-day retention, point-in-time recovery |