Security at TapMind

Where data lives. TapMind keeps identity, profile and ad-serving data in India, with backups in the same region as the data they copy. Content delivery and website hosting run at the locations listed on our sub-processor page: tapmind.com/legal/subprocessors.

How identifiers are protected. Advertising identifiers are read on the device when each ad is requested and never stored there, are sent over TLS 1.2 or higher, and are stored encrypted at the field level under managed keys with no routine human access. Serving logs are keyed on a pseudonym that cannot be linked back once a user's data is deleted.

What we don't collect. No precise location, no hardware identifiers, no device fingerprints, no contact details, no information users have given publishers about themselves. Every SDK release documents what it collects and what it stores on the device.

Access and audit. Role-based access; every privileged action (enabling a feature, changing a policy, deleting data) is logged with who, when and why, and retained for seven years.

Retention. Automated deletion at the maximum periods in our Privacy Policy, on every system that holds the data.

Incidents. A documented response plan with defined notification paths to publishers and regulators, exercised at least once a year.

Found a vulnerability? See tapmind.com/legal/security/disclosure.

Certifications. None claimed at present. When a SOC 2 or ISO 27001 engagement is completed, it will be listed here with its date.

Questions. Security questionnaires: privacy@tapmind.com.