# Tappr

DPP management platform

Research: https://www.safecli.org/company/usetappr.com
Company: https://usetappr.com

## Evidence status

Insufficient enterprise evidence
Source review: 2026-11-04T15:01:15.868Z
API: Unknown

Company-published claims, not independently verified controls. Unknown is not evidence of absence.

## Procurement checks

### Security assurance — Mixed claims — review

> Tappr is ISO 27001 certified, data is encrypted in transit and at rest, each brand’s data is isolated, sign-in runs through your own identity provider, and you can export everything at any time.

Source: https://www.usetappr.com/platform/
Reviewed: 2026-11-04T15:01:15.868Z

> Tappr is ISO 27001 certified, data is encrypted in transit and at rest, each brand’s data is isolated, sign-in runs through your own identity provider, and you can export everything at any time.

Source: https://www.usetappr.com/platform/brand-cloud/
Reviewed: 2026-11-04T15:01:15.868Z

> Trust Center: ISO 27001, EU hosting and encryption | Tappr

Source: https://www.usetappr.com/trust-center/
Reviewed: 2026-11-04T15:01:15.868Z

- [ ] Request the current audit report, scope, exceptions and expiry; confirm the vendor entity.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### SSO & provisioning — Not found


- [ ] Test SSO enforcement, user removal and privileged-account recovery.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Access controls — Not found


- [ ] Test least-privilege roles and cross-tenant access with separate test accounts.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Auditability — Not found


- [ ] Verify administrative and data-access events, retention and export.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Data handling — Company-published

> Open the list → Data Processing Agreement The contractual terms governing personal data processing.

Source: https://www.usetappr.com/trust-center/
Reviewed: 2026-11-04T15:01:15.868Z

> Request the DPA → Service status Current availability and published incident history.

Source: https://www.usetappr.com/trust-center/
Reviewed: 2026-11-04T15:01:15.868Z

- [ ] Review DPA, subprocessors, retention, deletion, residency and AI training use.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Reliability & support — Company-published

> Disaster recovery

Source: https://www.usetappr.com/trust-center/
Reviewed: 2026-11-04T15:01:15.868Z

> Product and supplier records are hosted on Google Cloud in the Netherlands (europe-west4), with the disaster recovery environment in Belgium (europe-west1).

Source: https://www.usetappr.com/trust-center/
Reviewed: 2026-11-04T15:01:15.868Z

- [ ] Request SLA, incident history, recovery targets and support escalation terms.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Product effectiveness — Not found


- [ ] Run a representative pilot against your current workflow; measure errors, missed cases, time saved and human review cost.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

## Decision

- Owner:
- Intended use and data sensitivity:
- Blocking requirements:
- Pilot success criteria:
- Unresolved risks:
- Decision and review date: