Security policy

About this policy

This policy explains how Tavo LLC (“Tavo”, “we”) protects the Tavo service, what we expect from the companies and people who use it, and how to report a security concern. It describes our practices. It is not a warranty or a guarantee, and it does not create any obligation beyond what is in a written agreement between Tavo and a customer. Our privacy policy explains what information we collect and why.

How we protect the service

We use safeguards that we consider reasonable for a business application of this kind, including:

Encrypted connections. The app, the dispatch service and this website only accept connections over HTTPS.
Protected passwords. Passwords are stored only as one-way hashes. Nobody at Tavo can read them.
Separate company data. Each company’s records are kept apart from every other company’s, and people only see the company they belong to.
Limited permissions. Only a company’s owners can cancel rides or add and remove drivers.
Limited access. Access to production systems is restricted to the people who need it to run and support the service.
Trusted providers. The service runs on established hosting and delivery providers, listed in our privacy policy.

We review and change these safeguards over time. We may add, replace or remove a measure when we judge that it improves the security of the service.

No guarantee

No system connected to the internet is completely secure. Although we work to protect the service, we cannot guarantee that information will never be accessed, disclosed, changed or lost through unauthorized access, failures of hardware, software or networks, or events outside our reasonable control. You use the service with that understanding.

What customers are responsible for

Security is shared. Each company using Tavo, and each person with an account, is responsible for:

Passwords. Choosing a strong password, not reusing it elsewhere, and not sharing it.
Devices. Keeping phones that use Tavo locked, up to date, and in their owner’s control.
Who has access. Inviting only people who should have access, and removing drivers and staff promptly when they leave.
What goes in. Entering only the information needed to run rides, and having the right to share any customer information they enter.
Telling us. Contacting us straight away if they believe an account has been compromised or used without permission.

Tavo is not responsible for loss or harm that results from a customer’s failure to meet these responsibilities, including activity by anyone who signs in with a customer’s credentials or uses an unlocked device.

Information the service is not designed for

Tavo is a dispatch and scheduling tool. It is not designed to store medical records, diagnoses or other protected health information, payment card or bank account numbers, government identification numbers, or similar sensitive information, and it should not be used for them. Tavo does not enter into business associate agreements. A customer that enters such information does so at its own risk and is responsible for its own legal obligations.

Third-party services

Tavo relies on outside providers for hosting, notifications, text messages, payments and app distribution. Each runs its own security program. We choose providers we consider reputable, but we do not control them and are not responsible for their acts, failures or security incidents.

Protecting the service

To protect the service and the people who use it, we may suspend or restrict an account, reset credentials, block traffic, or take other reasonable steps without notice when we suspect unauthorized access, misuse, or a threat to the service.

If something goes wrong

If we confirm a security incident affecting customer information, we will investigate, take steps we consider appropriate to contain it, and notify affected customers and authorities where applicable law requires us to.

Reporting a security issue

If you believe you have found a vulnerability, email greg@hellotavo.co with the details and how to reproduce it. We review every report.

While looking into an issue, please do not access, change or delete data that is not yours, do not degrade or interrupt the service, do not use automated scanning that sends heavy traffic, and do not share the issue publicly until we have had a reasonable chance to fix it. Nothing in this policy authorizes access to any account or data that does not belong to you. Tavo does not offer payment for reports.

Changes

We may update this policy at any time by posting a new version on this page with a new date. The version posted here is the current one.