Businesses entrust Tanca with their most sensitive data: the identity, income and contracts of every employee. This article answers the questions the legal department and the board of directors always ask before signing.
TO BE CONFIRMED BY THE COMPANY before publishing. This is an external-facing article; every figure and commitment in it may be quoted by customers or regulators. Tanca's legal department and infrastructure team must confirm every line before publishing. Cells marked to be added are parts the Help Center does not yet have a basis to write.
Where the data is stored
Tanca states on its homepage that data is encrypted and stored in Vietnam. This is important for businesses that must comply with regulations on domestic data storage.
| Item | Details |
|---|---|
| Data location | Vietnam |
| Encryption in transit | All connections over HTTPS |
| Encryption at rest | to be added — infrastructure team to confirm the mechanism and scope |
| Infrastructure provider | to be added |
| Backup frequency and recovery time | to be added |
| Certifications obtained | to be added — state the certification name and issue date specifically, not in general terms |
What the business can control
Most risks to HR data come not from outside but from overly generous permissions granted internally. Tanca puts the following tools in the hands of the business's administrators:
| Tool | Guide article |
|---|---|
| Four access groups divided by management level | C1-01 |
| A permissions matrix detailed down to each action, across 12 modules | C1-02 |
| Data scope limits by branch and department | C1-03 |
| Granting and revoking individual permissions per person, separately for web and mobile | C1-04 |
| Resetting passwords for employees | C1-05 |
| Activity log recording the device and IP address | C1-07 |
What Tanca doesn't have yet — plainly stated
The Help Center documents the current state accurately so businesses can assess the risks themselves instead of discovering them after deployment.
| Not yet available | Impact | Workaround |
|---|---|---|
| Two-factor authentication for web accounts | The password is the only layer of protection | Require strong passwords, change them periodically, revoke immediately when someone leaves |
| Remote logout of a device | A suspicious session can't be cut off instantly | Change the password immediately upon suspicion |
| Permission change log | You can't trace who granted a permission | Keep your own permissions log (article C1-07) |
| System-wide activity log page | Reviews are labor-intensive | Review key profiles first |
| Compliance module | No centralized compliance tracking tool yet | Currently marked Coming soon in the product |
Answering customers who ask about security
- Refer to the Privacy Policy on tanca.io — this is the binding document; the Help Center only explains it and does not replace it.
- For security assessment requests or vendor due diligence documents, forward them to the responsible Tanca team via the hotline 028 7899 9899.
- Do not make any additional commitments beyond what is stated in the policy.
