Security is part of the workflow.

Use individual accounts, strong authentication where available, least-privilege role assignments and prompt removal of access that is no longer needed. Organisation administrators should periodically review user access.

Only enter information needed for authorised business workflows. Avoid sharing credentials or secrets in support requests. Data classification, encryption settings, backups and retention controls should be verified against the specific deployment and its configuration.

Secure operation includes keeping application dependencies maintained, restricting administrative access, monitoring relevant events, and having a process for responding to suspected incidents. The specific controls and service providers may vary by deployment.

Customers should protect their own devices and credentials, configure roles carefully, validate the accuracy of operational and financial records, and notify the service team promptly if they suspect unauthorised access.

If you believe you have discovered a security issue or unauthorised disclosure involving TAVRÉ OS, use the contact route provided by your organisation or service agreement. Include enough detail to help investigate, but do not send passwords, access tokens or live sensitive customer data.

Certifications, independent audit reports, penetration-test summaries, hosting-region commitments and formal security service levels should only be represented when verified and applicable to the deployment. Contact the team to discuss the documentation available for your environment.