Encryption in transit
HTTPS/TLS protects web traffic, including authentication and operational data moving between TankActive and your browser.
Security
How TankActive protects your operation's data
Every claim on this page is backed by product behavior and published policy — no badge wall, no unverifiable certifications.
This page describes security practices at a high level. It is not a certification registry or a substitute for the privacy policy. We intentionally avoid claiming audits or certifications that are not publicly documented here.
How is TankActive data secured?
TankActive protects web traffic with HTTPS/TLS, hashes passwords, rotates authentication tokens, manages sessions, and applies role-aware authorization checks. Account-lifecycle workflows can revoke access. These controls describe repository-backed behavior at a high level; they are not an independent audit or certification.
Secure authentication
Password hashing, token rotation, and session controls reduce unauthorized-access risk. Microsoft Entra ID single sign-on is available for organizations.
Access controls
Role-aware access checks, administrative separation, and audit-oriented workflows govern who can see and change information across the product.
Data handling
Account deletion workflows are supported, and retained personal data is limited to what operations and applicable recordkeeping require.
What practices are in place?
TankActive combines application, data, access-management, and operational safeguards. In the repository, these appear as request validation, browser security headers, authorization checks, scoped data access, account lifecycle controls, deployment workflows, monitoring, and a direct support escalation path.
Application security
- Secure coding and code review practices
- Input validation and request hardening
- Content Security Policy and browser security headers
- Authentication and authorization checks
Data security
- Protected transport for operational and authentication traffic
- Scoped storage access and database query controls
- Token revocation during account lifecycle changes
- Account deletion and anonymization workflows
Access management
- Password reset protections
- Role-aware access restrictions
- Administrative separation for user-management actions
- Session and token lifecycle controls
Operational security
- Operational monitoring and logging
- Controlled deployment workflows
- Post-deploy smoke checks
- Direct escalation path through support
How do I report a security concern?
Security questions and urgent concerns are routed through support for review and response — include steps to reproduce where possible.