Security & Trust

Monitoring, logging & auditability

We maintain operational logs to help secure the service, troubleshoot issues, and investigate suspected misuse. Log access is restricted. Where supported in the product plan, customer-facing audit events may be available (for example, sign-in events, admin actions, and key configuration changes).

Incident response

• We triage security reports, contain impact, and perform root-cause analysis.
• We aim to notify affected customers without undue delay when we confirm a security incident involving their data and when notification is appropriate.
• We maintain internal procedures for recovery and post-incident improvements.

To report a suspected vulnerability or security incident, contact [email protected].

Data handling boundaries (HRIS integrations & OAuth)

• Customer-controlled connections: HRIS and third-party connections are initiated and managed by the customer/admin through their accounts.
• Scoped permissions: We request only the API scopes/permissions needed for the integration features enabled.
• Token protection: OAuth credentials/tokens (if used) are stored securely and access is restricted to the integration functions.
• Data minimization: We aim to ingest and store only the fields required to provide the selected service features.
• Customer responsibility: Customers are responsible for ensuring they have the rights/authority to connect third-party systems and to share workforce data with us.

Anti-phishing & communications

We will not ask for your password by email. Verify that login pages and links use the official domain: taxonoskills.sbs. If you receive a suspicious message, forward it to [email protected].