Security

Access model

Tacet connects to client systems with the minimum access required to deliver the Service. The exact permissions we request are listed below.

• Access to your Shopify store is read-only
• Scores are delivered through the Klaviyo connection your admin authorizes with a sign-in, where Tacet writes them onto customer profiles as named properties and builds lists and segments
• Tacet sends nothing to your customers unless an admin in your own organization has approved that specific play
• We never change your prices, products, or orders

When Tacet acts for you

Tacet can propose a play: a specific audience, message, and send time. Nothing happens until an admin in your organization approves it. Tacet staff cannot approve a play. A proposed play that nobody approves expires after 7 days.

• After approval, Tacet works through your own Klaviyo account: it loads the approved audience into a new list, copies one of your templates and applies the approved message, creates the campaign, and sends. It can cancel a send before it goes
• Today, plays send email campaigns only. Tacet does not create flows, load coupon codes, or create discount codes in your Shopify store
• Every send stays inside the sending rules for your store. Tacet’s standard rules apply by default, and your admin can adjust them: how much of each audience is held back, quiet hours, the wait before a send, and how many customers one send may reach
• Every send leaves out a persistent holdout group, a comparison group for that play, and every customer without marketing consent
• You can pause everything at any time, and cancel a send inside the undo window
• A permanent ledger records who approved what, when, and what was sent

You are the controller of your customer data and the sender of record for every message. Tacet acts as your processor, on your documented instructions: your agreement, your sending rules, and each approval. Marketing consent remains your responsibility. Tacet relies on the consent status held in Klaviyo and Shopify. The contractual version is Section 2.3 of our Terms.

Permissions we request

These are the exact scopes Tacet asks for when you connect each platform.

Shopify

Read only. Tacet requests no permission to write to your store.

Klaviyo

Your admin connects Klaviyo from the portal with a Klaviyo sign-in, and can disconnect it there at any time. Disconnecting also revokes the grant at Klaviyo. The connection asks for:

Read: profiles:read events:read metrics:read lists:read segments:read subscriptions:read templates:read campaigns:read flows:read

Write: profiles:write events:write lists:write segments:write templates:write campaigns:write flows:write coupons:write coupon-codes:write

Tacet uses them as this page describes: to write scores onto profiles, record events, build lists and segments, and carry out the plays your admin approves. Plays today send email campaigns only, so they don’t use the flow or coupon permissions. Before it acts, Tacet checks the permissions your connection actually granted and refuses anything it wasn’t given.

How your data is protected

• A separate database for each brand. Your data lives in its own database instance, not in rows beside other brands’ data.
• No public way in. The engine that stores and serves your data is not publicly invokable: Google Cloud refuses any call that doesn’t come from an authorized Tacet service, and each call must also carry a signed sign-in token whose organization decides whose data comes back. The databases have no public IP address.
• Encryption. Data travels over TLS. The databases are encrypted at rest by Google Cloud, and personal fields such as customer email addresses are encrypted again, column by column, with AES-256-GCM. Your Klaviyo connection’s tokens are stored encrypted, Tacet’s service keys and credentials are held in Google Secret Manager, and score archives carry no names or email addresses.
• Region. Tacet’s engine and every brand’s database run on Google Cloud in the us-central1 region, in the United States.
• Staff access. Tacet’s staff tools check, on every request, that the caller belongs to Tacet’s staff organization and holds an admin role. Engineers reach a database only through Google’s Cloud SQL Auth Proxy, signed in with their own Google Cloud account. No one at Tacet can approve a play for you. Who can see your portal is answered on our FAQ.
• Portal sign-in. Everyone who uses the portal signs in through Clerk, our sign-in provider, as a member of your organization. The engine checks that sign-in on every request and returns only your organization’s data.

Service providers

Tacet uses these providers to deliver its services to you. The list matches Section 9 of our Privacy Policy.

Shopify and Klaviyo are your own platforms. Tacet connects to them with your authorization and acts in them only as this page describes. The analytics and form tools on our website are listed in the same section of the Privacy Policy.

Data lifecycle

We retain client data only as long as necessary to provide contracted services and meet legal obligations.

• If you uninstall the Shopify app, Tacet’s access ends at once. Customer-level data (customers, orders, and their scores) is deleted when Shopify’s deletion request arrives, 48 hours after the uninstall
• Your admin can disconnect Klaviyo from the portal at any time, which also revokes Tacet’s access at Klaviyo
• When a subscription ends, personal data is deleted in accordance with our contractual agreements
• The ledger of approvals and sends is kept as a permanent record

What we never do with client data

We do not sell client data.

We do not use identifiable client data for our own advertising or marketing.

We do not contact your customers on our own behalf. A message goes out only when your admin has approved that play, and it is sent from your own account.

Anonymized, aggregated data that cannot identify any individual or business may be used to improve our models, as described in our Privacy Policy.

Compliance

Tacet has not completed a SOC 2 audit, and holds no ISO 27001 certification. A gap analysis in March 2026 set out which controls are already in place and what remains. We’ll complete your security questionnaire, and our Data Processing Agreement is available on request.

Reporting a security concern

If you believe you have found a vulnerability in our website or services, we want to hear about it. Contact security@tacet.ai, or see security.txt. We review every report.

Questionnaires and the DPA

Our Data Processing Agreement covers our obligations as a data processor, including confidentiality, security measures, and deletion. To request a copy or send us a security questionnaire, write to legal@tacet.ai, or use the contact page and choose Security or privacy.

Shorter answers to the questions buyers ask most are on our FAQ.

Last updated: 27 September 2026