Owner numbers stay private
A public scan returns limited tag context and available actions. Stored owner and emergency-contact phone numbers are excluded from public responses.
Security
How we protect your data, and what we do not claim.
TagVomo is built so a stranger can reach you without learning who you are. This page describes the protections that exist in the product today. It is not a certification claim.
What protects you today
Owner-controlled access
Owners sign in with an owner key that is stored only as a hash. Sessions are signed and expire. Do-not-disturb, call and message rules are set by the owner.
Abuse limits
Scan messages and call requests are rate limited per tag. Requester network data is hashed with a secret salt before it is stored for abuse checks.
Short-lived access
Scanner conversations use temporary reply links that expire. One-time codes for recovery and doctor access expire after minutes and allow a small number of attempts.
Health data is gated
Owner-selected emergency fields can appear during a scan. Full medical history needs a verified doctor sign-in plus a short-lived patient OTP, and each access is logged.
Payments are not stored by us
Card and UPI details are handled by Cashfree. TagVomo does not store card or UPI numbers.
Platform practices
- Transport security headers, a strict content security policy, no framing by other sites, and no-index on tokenised scan pages.
- Secrets are held in environment or encrypted admin settings, never in the public site. Production refuses to start with missing or placeholder secrets.
- Logs and error reports are scrubbed of owner keys, authorisation headers, cookies and phone numbers.
- Administrative actions are written to an audit trail. Staff portals use role-based sessions.
- Dependencies are audited in CI and high or critical advisories block release.
What we do not claim
TagVomo does not currently hold ISO 27001, SOC 2 or similar certifications, and we do not display badges for them. An independent third-party penetration test has not yet been completed; our internal testing does not replace one. We will say so here when that changes.
Some channels depend on providers being configured for production: WhatsApp, SMS, voice and payment gateways. Until a provider is live for your region, the product falls back to the in-app inbox and says so.
Your part
- Keep your owner key private. TagVomo staff will never ask for it, an OTP, a PIN or a medical record by email or chat.
- Turn on do-not-disturb rules that fit your situation and review your inbox and activity in My account.
- If you think a tag is lost, stolen or misused, disable or replace it from My account.