Security

For anyone reviewing Tabla before their organization uses it: where data is kept, how it is protected, and the documents a review needs. Records live in Germany, files and backups in the European Union, and the whole of it can be exported at any time.

Documents

• Data processing agreement — GDPR Article 28, with the EU’s standard contractual clauses. Part of the Terms, and available signed on request.
• Subprocessors — who else handles the data, where, and what covers each transfer.
• Privacy policy, Terms of service and legal notice.

Have a security questionnaire, or need a document signed? Send it to support@tabladb.com and we’ll answer it.

How Tabla is run

Where data is kept

• The database that holds every record runs on Tabla’s own server at Hetzner in Nuremberg, Germany, in a data center whose operator is certified to ISO/IEC 27001.
• Uploaded files and the database’s backups are stored with Cloudflare R2 under its EU jurisdiction, which keeps them inside the European Union.

Encryption

• Every connection uses HTTPS with TLS 1.2 or newer, and browsers are told to accept nothing else.
• The database and the server’s logs are stored encrypted (AES-256). Files and backups are encrypted at rest by the storage provider.

Signing in, and who can see what

• People sign in with a link emailed to their own address, which expires after 15 minutes. Tabla stores no passwords, and keeps sessions, API keys and invitation links only as one-way hashes.
• A session ends 30 days after it was last used.
• Each database has its own members, each an owner, editor or viewer, and every request is checked against that role before anything is read or written. API keys can be limited to chosen databases, and to reading only.
• Every table a customer makes is a table of its own in the database, never rows mixed into a table shared with other customers.

Our own access

• Only Tabla’s operators can reach the server, with SSH keys; password logins are switched off. The firewall admits web traffic and SSH and nothing else, and the database and file store can’t be reached from the internet at all.
• We don’t read what customers store. When a support request needs us to look at a database, access is read-only, expires, needs a written reason, and every grant is logged.
• Everyone with access has committed to keeping what they see confidential.

Keeping it running

• Every change to the database is copied to separate storage in the EU within about two minutes, on top of a full copy every night, kept for 30 days. Restoring is a written procedure, tested on the live system, and at most a couple of minutes’ changes could be lost.
• Deleted records, fields and tables wait in a trash for 7 days before they’re removed.
• Security updates install automatically, and every change to Tabla passes its automated tests before it ships.
• An outside service checks every few minutes that Tabla is up, and errors are recorded and grouped on our own server so they are found and fixed quickly.

Logs and recordings

• Web server logs and error reports are kept for 90 days, and our record of product activity for 13 months.
• Session recordings hide what’s in records, can be opened only by Tabla’s own team, are never shown or handed to a customer’s organization, and are deleted after 30 days. A team account’s admins can switch recording off for everyone in it.

If something goes wrong

• If personal data an account stores in Tabla is ever exposed, we tell that account’s admins without undue delay, and within 48 hours of learning of it, with what we know, and keep them updated.
• Security problems can be reported to support@tabladb.com, as security.txt says.

Leaving

• Any database can be exported whole at any time, on every plan: its tables as CSV, its files as files, and its structure as JSON.