Security and privacy
Trust Center
The Trust Center presents t-api's current technical and organisational posture, the main data flows and deliberately limited public commitments.
Tocco remains the leading system
People, events, registrations, attendance, grades and exam structures remain in the respective education provider's Tocco instance. The portal reads and writes business data only for the specific process and customer portal being used.
t-api does not replicate business Tocco tables or transfer data between customer instances.
Data minimisation
The platform database contains technical data for customer-portal configuration, authentication, sessions, rate limiting, audit, monitoring and operations. Business data may be processed only transiently in memory.
The public website uses neither marketing tracking nor advertising networks. The contact form uses only host-bound CSRF, pseudonymised rate limits and Cloudflare Turnstile for abuse prevention; message content is not stored in PostgreSQL.
Encryption and secrets
Connections use TLS. Tocco and optional SSO credentials are encrypted at rest with AES-256-GCM and are not readable in admin, logs or exports.
Business value details in necessary audit evidence are also encrypted at application level and cryptographically bound to the relevant customer portal.
Customer-portal isolation
Every request is mapped server-side from its subdomain to a customer portal. Sessions, database access, cache keys, business limits, audit and monitoring remain bound to that customer portal.
Automated tests with two customer portals and IDOR-negative tests verify that data and sessions cannot be reached across customer-portal boundaries.
Access protection
Portal access uses the personal Tocco username, one-time codes sent to its linked email address and host-bound sessions. Operator admin is separate and requires a password plus WebAuthn passkey.
Permissions and visible tasks are derived server-side from current Tocco relationships; sign-in alone does not grant access to a business process.
Audit and retention
Sign-ins, security events and business write operations are audited separately for each customer portal. Technical application logs contain no names, email addresses, one-time codes, grades or attendance values.
Audit value details are redacted after 24 months by default; security-relevant core records remain for 10 years. Activity and monitoring data have substantially shorter periods.
Hosting and subprocessors
The current operating tier uses Vercel for static web delivery and serverless functions in fra1 and Neon PostgreSQL in eu-central-1. Preview and production use separate databases.
Vercel and Neon are US providers. DPAs and Standard Contractual Clauses are in place; both are listed as subprocessors in customer DPAs.
Operations and recovery
Liveness, readiness, technical metrics for each customer portal, Tocco health, alerting, daily retention jobs and regular restore exercises form part of the operating model.
The current backup target is RPO no more than 5 minutes, RTO no more than 60 minutes and a restore window of at least 4 hours; actual evidence is recorded monthly.
Customer-specific approvals
Before activation, every production education provider receives an individual contract, data processing agreement, current subprocessor list, and agreed support and retention rules.
A production customer portal is activated only after capability checks, privacy and security gates, customer UAT and documented approval.
What we deliberately do not claim
t-api does not claim ISO 27001, SOC 2 or comparable certification. The platform is not described as hosted exclusively in Switzerland or automatically compliant for every use.
Security and privacy measures reduce risk but do not eliminate it. Contract, privacy and legal review remain necessary for each education provider and use case.