1. Local-First Sandboxing
TAR runs as a native Android application. Operational records, local transaction tables, and cache files reside within OS-level app sandboxes with hardware-backed encryption.
2. Zero Workspace Write Credentials on Device
The mobile app communicates via authenticated API gateways. The client device never receives direct raw database administrative write credentials, preventing unauthorized table mutations even if a device is physically compromised.
3. Encryption in Transit (TLS 1.3)
All network traffic between TAR mobile clients, API gateways, messaging interfaces (WhatsApp, Telegram, Google Chat), and AI inference providers is strictly encrypted using TLS 1.3 with modern cipher suites.
4. Role-Based Access Control (RBAC)
Workspace owners maintain fine-grained controls over what invited staff, doctors, or dispatchers can view, approve, or execute across connected channels.
5. Vulnerability Reporting
We welcome responsible security disclosures. If you discover a vulnerability, please email our security team directly at security@tarfw.com.