Tacto is ISO 27001 certified – the internationally recognized standard for information security management systems. The certification is maintained through annual external audits and demonstrates that Tacto operates its security processes, risk management and protective measures to the highest industry standards.
1. Summary
Tacto operates a SaaS solution for industrial procurement. Security and data protection are our top priority. Our architecture is based on the "security by design" principle and uses Microsoft Azure's certified infrastructure in the European Union.
This document confirms that communication with the Tacto portal is secure and complies with current industry standards (in line with ISO 27001, SOC 2 and BSI recommendations).
2. Infrastructure & certifications
Tacto does not host any servers "on-premises" but relies entirely on a cloud architecture that meets the strictest compliance requirements.
Cloud provider: Microsoft Azure (regions: "Germany West Central" and "West Europe")
Data center certifications: The underlying infrastructure is certified to ISO/IEC 27001, SOC 2 Type II and TISAX
Data location: Guaranteed data storage exclusively in the European Union (EU/EEA). No data is transferred to third countries
Tacto compliance: Tacto is ISO 27001 certified. All subcontractors also hold the relevant certifications
3. Network and transmission security
To justify whitelisting our domain, we rely on comprehensive protection mechanisms against attacks and malware:
Encryption in transit: All data traffic between the user's browser and our servers is always encrypted using TLS 1.3 (Transport Layer Security). We use SSL certificates from Let's Encrypt
Email encryption & VPN tunnels: Internal communication and remote access take place via encrypted channels (email encryption and VPN-secured connections)
Malware protection: All files uploaded to the portal automatically go through Azure Storage Malware Scanning. This prevents malicious files from being distributed via our platform
Network protection: Anti-DDoS layers, web application firewalls (WAF) and continuous network monitoring to fend off attacks
4. Data security & encryption (data at rest)
Data confidentiality is ensured by strong cryptographic methods:
Encryption at rest: All databases, backups and file storage are encrypted with AES-256-bit encryption
Key management: Central management of cryptographic keys via Azure Key Vault with strict rotation and access control
Backups: Encrypted backups are stored with local redundancy in Germany and the Netherlands (30-day retention, point-in-time recovery)
5. Availability & backups
Tacto guarantees high availability and continuous operation:
Backups several times a day, stored separately
99% availability SLA per year
24/7 monitoring & incident response
6. Access control & authentication
Access to the portal is strictly regulated:
Single sign-on (SSO) & two-factor authentication: Authentication takes place via established identity providers (e.g. Microsoft Entra ID / Azure AD) using SAML or OIDC. MFA is supported and enforced by the customer's identity provider
Role and permission concept: Each user receives only the rights required for their role (principle of least privilege)
Tenant separation: Strict logical separation of data at application level ensures that customers and suppliers can only access their own data
Complete logging: All access to the system is fully logged and kept available for audits
7. Transparency & audit rights
Customers can review Tacto's security measures at any time:
Right to audit: Customers are entitled to review Tacto's security measures at any time or have them reviewed by third parties
Current attestations & certificates: The ISO 27001 certificate and further evidence are available on request
Complete logging of all access ensures full traceability
8. Vulnerability management & penetration tests
Tacto runs active security management to continuously harden the portal:
Penetration tests: Regular penetration tests are carried out by external security firms. The most recent test (2025) found no critical vulnerabilities
Patch management: Daily automated scans for CVE vulnerabilities
High risk: fixed within 24 hours
Medium risk: fixed within 3 days
9. AI security (EU AI Act)
The AI features integrated into Tacto are classified as a limited-risk system under the EU AI Act.
Data protection: Customer data is not used to train the base models
Human in control: The AI acts purely as an assistant; decisions are made by the user
10. Data protection & GDPR compliance
Tacto guarantees compliance with the European General Data Protection Regulation (GDPR). Since personal data (e.g. contact persons at suppliers) is processed in the procurement process, we provide legal and technical certainty:
Legal basis (DPA): Processing takes place on the basis of a data processing agreement (DPA) pursuant to Art. 28 GDPR. It sets out in detail the categories of data processed, the purposes and the rights of data subjects
Appointed data protection officer: Tacto has an appointed data protection officer (DPO) who monitors compliance with GDPR requirements
Confidentiality obligation: All employees are contractually bound to confidentiality regarding processed customer data
Data residency in the EU: We contractually guarantee that all data is stored and processed exclusively in the European Union (Microsoft Azure EU Data Zones, primarily Germany and the Netherlands). No data is transferred to third countries to provide the application
Technical and organizational measures (TOMs): To protect personal data, we have implemented comprehensive TOMs (physical access, system access and transfer control, etc.) based on established standards such as ISO 27001
Data protection when using AI: Even when you use our AI features (Azure OpenAI), data does not leave the European jurisdiction. Microsoft Azure acts as a processor bound by instructions; it is contractually guaranteed that customer data is not used to train the AI base models
ISO 27001:2022 certification
Tacto is certified to ISO 27001:2022, issued by a DAkkS-accredited certification body. The certification is valid for three years and is confirmed by annual surveillance audits. ISO 27001 is the international standard for information security management systems; the certification confirms that Tacto's information security management system has been independently audited and validated against this standard.
You can request certificates and further security documents (e.g. penetration test results) via the Trust Center: trust.tacto.ai.