Security and vulnerability reporting
Takt is operated by RevenuePilot. This page describes the service architecture and how to raise a security concern; it is not a security certification.
Access and isolation
Takt checks authenticated accounts, active workspace membership and role capabilities on the server. Plant-data queries are scoped to the authorized workspace. PostgreSQL row-level security is enabled on company-owned tables, and a session working inside one company sees only that company's rows. Account permissions are separate from floor-persona and crew labels.
Data protection and operational limits
The service uses HTTPS, protected provider credentials and attributable operational and access records. AI remains optional and requires review for proposed actions. Backup and recovery arrangements are operated separately from the application; request current recovery evidence and agreed objectives for your service. No SOC 2, ISO 27001, Zero Data Retention, uninterrupted availability or automatic failover claim is made.
Report privately
Use the security contact below to request a confidential response channel. Initially send only a short summary and a way to reach you. Do not include credentials, customer records, exploit details or attachments until a restricted channel is confirmed. Do not publish vulnerability details in public issues or ordinary support requests.
Testing and coordinated disclosure
Do not access other customers’ data, disrupt production, attempt social engineering or perform destructive tests. Use only isolated synthetic workspaces with explicit testing authorization. Stop if you encounter confidential data and contact us privately. Coordinate disclosure after remediation is assessed; this page does not promise a bounty, legal safe harbor or fixed response time.