Security

How Tarkle works

Tarkle is a suite of white-label tools for client-facing businesses: Send for file sharing and tracking, Portal for client delivery and billing, and Crew for contractor management. Each product handles different types of data on behalf of businesses and their clients. None of them are consumer products — they are business tools, and we design security accordingly.

Architecture and data flow

Send

Files are uploaded to Tarkle by businesses or their clients. Files are encrypted in transit and stored in Cloudflare. Backblaze B2 provides redundant backups in case of unlikely Cloudflare failure for recovery purposes. Sharing links use cryptographically random tokens. Links can be password-protected, set to expire, or restricted to email-gated access on the Send Professional plan. Recipients access files through a branded portal under the business's own domain — Tarkle is not visible to end clients.

Portal

Work orders, deliverables, approvals, and payments are managed between an agency and its clients. Data is stored in Supabase (PostgreSQL on AWS). Client access is scoped strictly per workspace — no workspace can see another's data. All client-facing interactions happen under the agency's custom domain.

Crew

Contractor profiles, contracts, invoices, and payment records are stored per workspace. Identity verification for contractors is handled by Veriff (KYC/KYB). Contracts are signed via SignatureAPI. Tarkle never holds or routes payments — all payments go directly between the business and its contractors. Tarkle records the transaction only.

Data and sub-processors

Each service below processes some form of customer data as part of operating the platform. We keep this list minimal.

This is a partial list of key sub-processors. For the complete list, see our Privacy Policy.

Data retention

• —Files and workspace data are retained for the lifetime of your workspace or until you delete them.
• —Deleting a file removes it from storage within 30 days. You can request immediate hard deletion through our contact page.
• —Deleting your workspace removes all associated files, portal data, and user records. You can export everything first.
• —Database backups are retained for 90 days in encrypted storage, then permanently deleted.
• —For Crew: identity documents submitted through Veriff are processed and retained by Veriff under their own policies. Tarkle stores only the verification outcome (verified / not verified).

Encryption

In transit

All connections use TLS 1.3. File uploads, downloads, and API calls are served over HTTPS. Portal and contractor sessions use HTTPS throughout. No data is transmitted in plain text.

At rest

All files are stored primarily in Cloudflare with Backblaze B2 providing redundant backups for unlikely recovery scenarios. All files and database records are encrypted at rest using AES-256. All database records in Supabase (user accounts, workspace settings, file metadata, contract records, payment logs) are encrypted at rest using AES-256 managed by Supabase's infrastructure layer (AWS).

Passwords

User passwords are hashed using bcrypt and never stored in plain text. Authentication is handled by Supabase Auth.

Sharing links

All file sharing links use cryptographically random tokens. Optional password protection adds a second layer. View-only and burn-after-read modes are available on the Send Professional plan.

Access controls

• —Workspace data is strictly scoped by workspace ID. No workspace can access another workspace's files or data through the API.
• —Team members have role-based access. Workspace owners assign Admin, Member, or View-only permissions.
• —Contractors in Crew can access only their own portal. They see their own contracts, invoices, and payment status — not internal workspace data or other contractors' records.
• —Clients in Portal access only what has been explicitly shared with them via their unique link or login. They cannot see your workspace or other clients' data.
• —Cloudflare WAF provides DDoS protection, rate limiting, and country-level blocking on all public-facing endpoints.

Privacy

Tarkle collects only the data necessary to operate the platform. No tracking pixels. No third-party advertising integrations. We do not sell your data or use it for advertising.

Analytics on the marketing site uses Vercel Analytics, which collects anonymised performance data and does not track individuals or create user profiles. No advertising cookies are set anywhere on Tarkle properties.

For Data Processing Agreement requests, visit our contact page.

What we have and what we don't yet

We are an early-stage, self-funded team. We think honesty here matters more than claims we cannot back up. Here is where we actually stand.

Our infrastructure providers — Cloudflare, Supabase on AWS, Backblaze, and Vercel — maintain their own SOC 2 Type II compliance and security certifications. We inherit the security of that infrastructure layer.

We do not currently publish formal SLAs, RTO/RPO targets, or guaranteed uptime percentages. We are working toward formalizing these as the product matures.

We are a small team. We do not have a dedicated security engineer or a 24/7 security operations centre. We monitor systems, respond to incidents, and apply patches as quickly as our team size allows. If that matters for your use case, you should weigh it accordingly.

Vulnerability disclosure

If you discover a security vulnerability in Tarkle, please report it responsibly through our contact page. Do not publicly disclose it before we have had a chance to address it.

• —We aim to acknowledge reports within 48 hours.
• —For critical vulnerabilities, we aim to provide a fix timeline within 5 business days.
• —We appreciate responsible disclosure and will credit researchers who report valid issues, unless you prefer to remain anonymous.