Tapenda

Security

How to tell a real Tapenda message from a fake one, and how to reach us about either.

Our domains

These are the only internet addresses we operate:

  • tapenda.app — this site, the application and the API
  • tapenda.page — booking pages published by businesses that use Tapenda
  • tapenda.co — registered by us and held in reserve; nothing is served from it today

The app itself is only ever at https://app.tapenda.app, and our email only ever comes from an address ending in tapenda.app.

Any other domain that carries this name is not ours. That includes tapenda.com, which belongs to an unrelated German company, and anything else you may find — a hyphenated variant, a different ending, a lookalike spelling. If a link asks you to sign in to Tapenda and the address is not one of the three above, it is not us. Pages under tapenda.page are published by individual businesses using the product; they are hosted by us, but their content is the business’s own and we never ask for account credentials on them.

What we will never do

  • We will never ask you for your sign-in code. Tapenda has no passwords — you sign in with a one-time code emailed to you, or with Google. That code is asked for on one screen only: our own sign-in page, opened by you. Nobody from Tapenda will ever ask for it on WhatsApp, by SMS, by email or on a call. If somebody does, they are trying to take your account, and the code they are asking for is the key to it.
  • We will never ask you to pay outside the app. No bank transfer, no crypto, no payment link sent in a chat, no “your subscription failed, pay here”. When paid plans open, payment happens inside the app through our payment processor and nowhere else.
  • We will never ask for your WhatsApp verification code, your Google password, your card’s full number or its CVC, or remote access to your device.
  • We do not cold-call businesses to “fix an account problem”, and we do not send attachments you were not expecting.

If a message claiming to be from us contradicts any of the above, it is not from us — no matter how well it copies our wording, our logo or our green. Do not reply and do not tap the link: open https://app.tapenda.app yourself and check there.

Report a phishing attempt or a fake Tapenda

Forward it to securitytapenda.app — the message itself if you can, or a screenshot with the sender’s number or address and the full link visible. We act on these: a lookalike domain or a fraudulent page gets reported for takedown, and where it affects other businesses using Tapenda, we warn them.

If you think you have already given something away — you entered a code on a page that was not ours, or somebody else is in your account — write to the same address and say so immediately. Speed matters more than certainty here; we would much rather examine a false alarm than find out a week later.

Responsible disclosure

If you are a security researcher and you have found a vulnerability, we want to hear about it. Write to securitytapenda.app with enough detail to reproduce the issue — the endpoint, the steps, and what you were able to reach. We acknowledge reports within three working days, keep you informed while we fix, and are glad to credit you when it is resolved. We do not run a paid bounty programme at this stage and we will say so honestly rather than let you assume otherwise.

What we ask of you while testing:

  • Use accounts and data you own. Do not access, modify or download another business’s data — if a flaw lets you, stop at the proof that it does and tell us.
  • No denial of service, no load or stress testing, no spam or social engineering of our people, our customers or their clients.
  • Give us reasonable time to fix an issue before making it public, and do not extract more data than is needed to demonstrate it.

Research conducted in good faith and within these limits is welcome, and we will not pursue legal action over it.

How the product is built

The short version, for anyone deciding whether to trust us with a client list: data is held on servers in the European Union; each business’s data is isolated inside the database itself rather than by application code alone; traffic runs over TLS; integration tokens and credentials are encrypted at rest; client photos live in a private bucket and are served only through short-lived signed links; sign-in is passwordless; and every change made in an account is written to an append-only audit record. Backups are encrypted before they leave the server. Our Privacy Policy sets out the detail, including who processes data on our behalf and for how long we keep things.

Tapenda is in early access and is not audited or certified; we will publish what changes when that changes, rather than implying more than we have.

Contact

Security, phishing and vulnerability reports: securitytapenda.app. Anything else: supporttapenda.app. Privacy requests: privacytapenda.app.