Your maps are safe. Your visitors are private.
TapTheMap is built with security at every layer. We protect your venue data with validated uploads, encrypted connections, and role-based access controls. We protect your visitors by collecting zero personal information.
Zero personal data from guests
When a visitor taps an NFC sticker or scans a QR code at your venue, TapTheMap opens your interactive map in their phone's browser. That is the entire interaction. No personal information is collected, stored, or shared.
What we do not collect from visitors
No names, no email addresses, no phone numbers, no device identifiers, no GPS coordinates, no browsing history, no advertising cookies, no third-party tracking pixels. TapTheMap does not create user accounts for visitors. It does not install anything on their device. There is nothing to opt out of because there is nothing to opt into.
What we do measure
TapTheMap uses two privacy-first analytics tools: Plausible and Umami. Both are cookieless. Both are GDPR and CCPA compliant by design. They measure aggregate traffic only: total page views, NFC versus QR scan source, and which points of interest visitors tap. No individual visitor can be identified from this data.
No session cookies for guests
The guest map viewer does not set session cookies. The server is configured with saveUninitialized: false, which means no cookie is created unless a user explicitly logs in through the admin interface. Visitors who tap a sticker and view your map leave no session trace.
Every upload is validated and verified
Your venue map is the core of your TapTheMap experience. We protect it with multiple layers of validation before it ever reaches your live page.
Magic-Byte Validation
Every uploaded file is inspected at the binary level. TapTheMap reads the first bytes of the file to verify it matches a known format (PNG, JPEG, or PDF). A file that claims to be an image but contains HTML, JavaScript, or SVG code is rejected automatically. This prevents disguised malicious files from reaching your venue page.
SHA-256 Integrity Hashing
After a map passes validation, TapTheMap computes a SHA-256 cryptographic hash of the file and stores it in your venue configuration. This hash acts as a digital fingerprint. If the file is modified after upload, the hash will not match, and the change is detectable.
Change Notifications
When a map is uploaded or replaced, TapTheMap sends an email notification to the venue contact address on file. The notification includes who made the change, when, and the file details. If a map changes and you did not expect it to, you will know immediately.
Automatic Version History
Every time a new map is uploaded, the previous version is archived automatically. TapTheMap keeps the 12 most recent versions. You can preview and restore any archived version from the admin dashboard at any time. No map is ever lost to an accidental overwrite.
Size and Dimension Limits
Uploads are limited to 5 MB per file. Image dimensions cannot exceed 10,000 by 10,000 pixels. PDF maps are limited to 5 pages. These limits prevent oversized files from affecting your venue page load times and protect server resources.
Structured Upload Logging
Every upload attempt is logged with structured data: venue, user, IP address, filename, file size, and timestamp. Failed uploads log the rejection reason. These logs support audit reviews and incident investigation.
Role-based permissions at every level
TapTheMap uses a six-tier role hierarchy. Each role has access only to the functions it needs. No more, no less.
- Six-tier role hierarchy. Viewer, Editor, Building Admin, Campus Admin, Client Admin, and Super Admin. Each tier inherits the permissions of the tier below it and adds specific capabilities.
- Tenant isolation. Each venue operates in its own data space. An admin for Venue A cannot access Venue B's maps, settings, POIs, or analytics. All routes verify that the authenticated user has a valid context assignment for the requested venue.
- Password security. All passwords are hashed with bcrypt at a cost factor of 12. Passwords are never stored in plain text. The system supports password reset via time-limited email tokens.
- Session protection. Sessions are regenerated on every login to prevent session fixation attacks. Cookies are set with
httpOnlyandsameSite: laxflags. Session cookies expire when the browser closes. - Account enumeration prevention. Failed login attempts always return a generic message. The system does not reveal whether a username exists. Password reset responses are identical whether the email is registered or not.
- Comprehensive audit log. Every login, logout, password change, user creation, role change, and suspension is logged with the acting user, target, IP address, and timestamp. Admins can search, filter, and export the audit log as CSV.
Secure from the server out
- HTTPS everywhere. All connections use TLS encryption via Let's Encrypt certificates. HTTP requests are redirected to HTTPS with a 301 permanent redirect. HSTS headers instruct browsers to always use HTTPS.
- Content Security Policy. A strict CSP header controls which scripts, styles, fonts, and connections the browser allows. Only approved CDN sources are permitted. Flash and Java plugins are blocked entirely.
- Subresource Integrity. External library files include SHA-384 hashes. If a CDN-hosted file is tampered with, the browser will refuse to execute it.
- Rate limiting. Login endpoints allow 5 attempts per 15-minute window. Admin routes allow 100 requests per 15 minutes. Public-facing pages allow 200 requests per minute. These limits defend against brute-force and denial-of-service attacks.
- CSRF protection. All state-changing requests require a cryptographic anti-forgery token. This prevents cross-site request forgery attacks from tricking authenticated users into performing unintended actions.
- Input sanitization. All user input is sanitized before rendering. SQL queries use parameterized statements exclusively. No user input is ever concatenated into a database query.
Server backups: The production server runs an automated weekly backup (Sundays at 3 AM) using AES-256-CBC encryption. Backups are stored in version control. Venue map archives and database snapshots are included in every backup cycle.
WCAG 2.1 AA compliant
TapTheMap is built to be usable by everyone. The platform meets WCAG 2.1 Level AA accessibility standards across all pages.
Keyboard Navigation
Every interactive element is reachable and operable with a keyboard. Skip-to-content links are provided on every page. Modal dialogs trap focus and close with the Escape key.
Color Contrast
All text meets a minimum 4.5:1 contrast ratio for normal text and 3:1 for large text. Focus indicators are visible on all interactive elements.
Semantic HTML
Pages use proper heading hierarchy, landmark elements, ARIA labels, and live regions. Screen readers can navigate every page effectively.
Touch Targets
All interactive elements meet the 44 by 44 pixel minimum touch target size. Filter chips support arrow-key navigation with toolbar roles.