Security

1. Security Overview

Cashflow applies practical administrative, technical, and organizational controls designed for business SaaS operations.

2. Core Controls

• Password hashing for stored credentials.
• Session protections with secure and HTTP-only cookies where supported.
• CSRF protections on sensitive mutating actions.
• Prepared statements in core financial data operations.
• Rate limiting on high-risk authentication flows.
• Server-side authorization checks for protected routes.
• Operational controls to restrict access to secrets, logs, backups, and deployment artifacts.

3. Infrastructure Dependencies

Cashflow runs on PHP/MySQL hosting infrastructure. Some controls depend on hosting provider and deployment configuration, including TLS, server patching, and baseline infrastructure protections.

4. Scope of Claims

• No SOC 2, ISO, PCI, HIPAA, or similar certification is claimed unless separately documented by TavoFusion Inc..
• No claim of perfect security or uninterrupted service is made.

5. Customer Responsibilities

• Use strong, unique credentials.
• Limit team access by role and business need.
• Maintain independent records needed for tax, legal, and accounting requirements.
• Report suspected unauthorized access promptly.

6. Security Reporting

Report suspected vulnerabilities to support@tavofusion.com with sufficient detail for investigation. Please avoid public disclosure until we complete initial review and response.

Mailing address: 1401 21st St #15871 Sacramento, CA 95811 United States

7. Incident Response Posture

Cashflow investigates credible incidents, performs containment and remediation actions, and issues notifications where appropriate or legally required.