Security at Tarkle

This page explains how Tarkle handles security today. Tarkle is an early-stage company, so this is a simple overview of the protections we already use, the parts we are still working on, and where to report a security issue.

Tarkle is a set of business tools for client-facing work. Send is for file sharing and tracking, Portal is for client delivery and billing, and Crew is for contractor management. Each product handles different kinds of business data, so each one uses separate rules for access and storage.

In our file delivery platform, files are uploaded by businesses or their clients, encrypted in transit, and stored in cloud infrastructure. Sharing links use random tokens, and links can also be protected with passwords, expiry dates, or email-gated access depending on the plan.
​

In our client portal software, work orders, deliverables, approvals, and payments are handled inside a workspace. Access is limited to the correct workspace, so one customer cannot see another customer’s data.
​

In our contractor management software, contractor profiles, contracts, invoices, and verification records are stored per workspace. The platform does not hold or route contractor payments, and identity verification is handled by third-party services.

Tarkle currently uses TLS 1.3 for data in transit and AES-256 for data at rest. It also uses Cloudflare WAF and DDoS protection, role-based access controls, and redundant backups.
​

Passwords are hashed and are not stored in plain text. Workspace access is scoped by workspace ID, and team members only see the data their role allows them to see.
​

Tarkle only collects the data needed to run the platform. It does not use advertising cookies, tracking pixels, or ad-based marketing on its own products. The privacy policy also explains how users can request access, correction, export, or deletion of their data.

Tarkle uses a small set of sub-processors for infrastructure, storage, email, payments, and verification. The full list is described in the Privacy Policy.

The following protections are active today:

Some security items are still on the roadmap. These include two-factor authentication, SOC 2 Type II, ISO 27001, third-party penetration testing, and formal published SLAs. Tarkle also does not currently run a dedicated security operations center.

If you discover a security issue, report it through the contact page. Tarkle asks for responsible disclosure and aims to respond within the timeframes listed in its security policy and contact guidance.
​

This version is better suited for a help article because it is direct, factual, and avoids marketing language while still explaining how the platform is secured.