Security

Tagl ID is built on a simple principle: the most secure server for your keys is no server at all.

How your identity is protected

Your keys never leave you. Your cryptographic identity lives inside your tagl — a PNG file on your device. Signing in proves control of your keys without uploading them. There is no server-side database of user keys to breach.

PIN protection, verified locally. The tagl is protected by a PIN you set. The PIN is checked on your device and is never transmitted to our servers. Possession of the file alone is not enough to use it — but treat any exposure of the file as an incident anyway (see "How to store your tagl").

Nothing to steal from us. The server side of Tagl ID stores no private keys, no TOTP secrets, no tagl contents, and no PINs. A full compromise of our infrastructure would not expose your keys — they were never there. The server holds only technical logs and sign-in protocol data (see the Privacy Policy).

Blind cloud backup. The optional cloud backup stores an encrypted copy of your tagl. Encryption happens on your device; the 12 recovery words that decrypt it never leave you. What we store is ciphertext we cannot read.

Encrypted transport. All communication with the Service happens over HTTPS (TLS).

Standard protocol. Sign-in uses OpenID Connect, the same widely reviewed protocol used by major identity providers, rather than a custom scheme. The protocol never requires our server to hold the keys embedded in your tagl.

The integrity boundary

The embedded data depends on the tagl remaining an unchanged PNG file. Editing, recompressing, or converting the file destroys that data even if the visible image still looks correct. Recovery works only from an intact backup copy; if every copy is lost or damaged, access is lost irreversibly — by design, no one but you ever had the keys.

What we ask of you

Security of this design has one dependency: your custody of the tagl file.

• Keep verified backup copies, in their original unmodified form — see How to store your tagl.
• Never share the file or your PIN with anyone. The Operator will never ask for either; neither will a legitimate site.
• Protect the devices and storage locations that hold copies.

Report a vulnerability

We welcome good-faith security research.

Where: [email protected].

Include: the affected component, a description of the issue and its impact, reproduction steps using only files, identities, and systems you control, and a way to reach you. Do not include your PIN, private keys, TOTP secrets, or a working tagl in the report.

Please do not:

• access, alter, or delete data that does not belong to you;
• run automated scanning at volumes that degrade the Service, or any denial-of-service testing;
• use social engineering or attempt to obtain another person's credentials;
• publicly disclose an issue before we have had a reasonable opportunity to fix it.

We commit to not pursuing action against researchers who act in good faith within these rules. We will acknowledge your report and keep you informed of the fix. There is currently no paid bug bounty program; we credit researchers who wish to be named.

Reports may be PGP-encrypted: public key, fingerprint 91B6 BE63 35AA BEB6 CA0B E10D 0871 E564 5AB3 B18B.

Machine-readable version: /.well-known/security.txt (RFC 9116, signed with the same PGP key).

Honest limitations

The Service is in public beta. It has not yet undergone an independent third-party security audit; we will state it here plainly when it has. We make no certification claims (SOC 2, ISO 27001) at this time.