If your company reviews Tomba's security and privacy before you buy, start with the documents below. Most are public pages on tomba.io, and you can ask for the rest by email.
Which documents can I read online?
Tomba's security and legal documents are public, and you don't need to sign in to read them:
Security Policy: how Tomba protects data.
Data Processing Addendum (DPA): how Tomba handles the personal data you upload, such as a list to verify.
Privacy Policy: what Tomba collects and why, and who it shares data with.
GDPR: Tomba's GDPR commitments.
Terms of Service and Acceptable Use Policy: the rules for using Tomba and its data.
status.tomba.io: live status and past incidents.
How does Tomba protect data?
Tomba's Security Policy describes these controls:
Data is encrypted while it travels, with TLS 1.3, and while it's stored, with AES-256.
Administrative access needs multi-factor authentication, and staff get only the access they need.
A web application firewall filters incoming traffic, and firewalls protect the servers.
Tomba runs regular security audits and penetration tests, and keeps an incident response plan.
Tomba doesn't store card numbers. It keeps only the last four digits, for support.
Does Tomba have SOC 2 or ISO 27001?
No. Tomba doesn't hold a third-party security certification of its own. The providers that host Tomba and process its payments hold theirs. Tomba's Security Policy and DPA describe the controls it runs, and Tomba answers security questionnaires as part of the Enterprise review.
How do I get a signed DPA?
The DPA is part of Tomba's Terms of Service, so it applies as soon as you accept them. If you need a countersigned copy for your records, email [email protected].
The DPA covers the personal data you upload to Tomba. Tomba's own contact database is covered by the Privacy Policy instead. The DPA's key terms:
Tomba tells you about a breach affecting your data within 72 hours.
Tomba gives at least 30 days' notice before it adds or replaces a sub-processor.
When your contract ends, Tomba returns or deletes your data within 90 days.
You can audit Tomba up to once a year, with at least 30 days' notice.
The DPA includes the EU Standard Contractual Clauses and the UK Addendum.
Where is Tomba's sub-processor list?
Email [email protected] for the current sub-processor list. A sub-processor is a provider that handles data for Tomba. Section 12 of the Privacy Policy also lists the providers Tomba shares data with, by type.
Can Tomba fill in our security questionnaire?
Yes. Tomba answers security questionnaires as part of the Enterprise review. Send your security questions with your Enterprise request, or email [email protected]. See Tomba Enterprise: what's included and how to get it.
Which security settings can my team control?
Every Tomba workspace can use these security settings:
Two-factor authentication: a code at sign-in, on top of the password.
Passkeys: sign in with a fingerprint, face, device PIN or security key.
Active sessions and sign-in notifications: see where you're signed in, and get an email when someone signs in from a new device or location.
Roles: Owner, Admin, Member and Guest, to limit what each person can do.
On the Enterprise plan, your team can also use SAML single sign-on and SCIM provisioning with your identity provider, the service your company uses to manage logins.
How do I report a security issue?
Email [email protected] if you find a security weakness in Tomba.
Related articles