security for IT and compliance teams
Security and compliance
Your files never leave your Mac. No network, no account, no telemetry, card data masked by default.
Tabulay 1.0.0. Last updated: 30 September 2026.
Security at a glance
- No network. Tabulay has no network entitlement: macOS blocks every connection. Nothing is uploaded, synced or sent.
- No account, no telemetry. Declared "Data Not Collected" on the App Store.
- Sandboxed. App Sandbox, Hardened Runtime, signed and reviewed by Apple. Tabulay opens only the files you pick.
- Card data protected by default. Card numbers are masked on screen, kept off clipboard history, flagged before a save, and truncated to the last four digits in one step.
- Locked-down query engine. SQL runs locally against the open file only: no other file, no extensions, one statement at a time.
- Enforceable. Every security setting can be locked with MDM.
How data is handled
| Network | None. The operating system blocks any connection. |
| File access | Only files you pick (user-selected, sandboxed). Folders you add are remembered as sandbox bookmarks. |
| Working copies | Files over 64 MB are copied into a local query database; very large queries can spill to temporary files. Both stay in Tabulay's sandbox container, are deleted when the file closes, and leftovers from a crash are deleted at next launch. Settings ▸ Security ▸ "Keep working copies in memory only" turns them off. |
| Queries | Local, against the open file only. File access, extensions and engine settings are locked once the file loads. |
| Profiles and insights | Computed in memory on the Mac. Never stored or sent. |
| Edits | In memory until you save. Saves are atomic. No autosave copies, no hidden versions. |
| Settings | Preferences, recent files and saved queries in the app's container. No file contents. |
| Crash reports | Only through Apple, if the user shares analytics in macOS. No file contents. |
| Feedback | Opens the user's own mail app. No file contents, names or paths. |
Card data protections
Tabulay detects card numbers (PANs) by length (13 to 19 digits), Luhn checksum and network prefixes, alone in a cell or inside text. A column is flagged when card numbers make up at least half of its long numbers, sampled across up to 5,000 rows. All protections are free, not part of Tabulay Pro.
| Protection | Default |
|---|---|
| Masked on screen, last four digits shown: grid, inspector, Remove Duplicates and Compare previews, query errors | On |
| Copies containing card numbers stay on this Mac (no Universal Clipboard) and are hidden from clipboard history apps | On |
| Warning before Save, Save As or Export writes full card numbers, with "Mask and Save" / "Mask and Export" | On |
| Warning for security code, PIN and track data columns (CVV, CVC, CID, PIN, track 1/2) | On |
| Data ▸ Mask Card Numbers: truncate every flagged column to the last four digits, one undoable step | Command |
| Working copies in memory only | Off |
Full values stay visible where you edit or type them: the cell editor, the SQL editor, filter chips, saved queries, and the Transform, Normalize and Import previews. Masking controls display and storage; anyone who can open the file can read it.
PCI DSS v4.0.1
| Requirement | Tabulay | Your part |
|---|---|---|
| 3.2.1 Minimal storage | Truncate to the last four digits before a file is kept or shared. | Retention policy. |
| 3.3.1 No sensitive authentication data | Track data, security code and PIN columns flagged on open and before every save. | Delete those columns at the source. |
| 3.4.1 PAN masked on display | Last four only, on by default. | Keep it enforced (MDM). |
| 3.4.2 No PAN copy over remote access | Card-number copies stay local and concealed. No remote connections. | Remote-access tool settings. |
| 3.5.1 PAN unreadable at rest | Truncation in one step; save warning while full numbers remain. | Mask before saving. |
| 3.5.1.2 Beyond disk encryption | Memory-only mode: no extra PAN copy on disk. | FileVault. |
| 4.2.1 Cryptography in transit | No transmission. | |
| 5.2, 5.3 Anti-malware | App Store distribution, signed, sandboxed, Hardened Runtime. | Endpoint protection. |
| 6.2.4 Secure software | Memory-safe Swift parsers with limits against hostile files; no macros or formulas; locked-down local SQL. | |
| 6.3.1 Vulnerability management | Published disclosure policy with fix targets. | Keep Tabulay updated. |
| 6.3.2 Component inventory | CycloneDX SBOM. | Add it to your inventory. |
| 6.3.3 Patching | Mac App Store updates. | Automatic updates or MDM. |
| 7, 8 Access control | No accounts: runs as the macOS user, opens only what that user picks. | macOS accounts, permissions. |
| 10 Audit logs | No audit trail of its own. | Unified logging, EDR, file auditing. |
| 12.8 Service providers | Not a service provider: the publisher never has access to your data. |
ISO/IEC 27001:2022, Annex A
| Control | Tabulay |
|---|---|
| A.5.9 Asset inventory | CycloneDX SBOM. |
| A.5.12 Classification | Card and authentication data columns flagged on open. |
| A.5.14 Information transfer | No network transfer; card-number copies stay on the Mac. |
| A.5.19 to A.5.22 Supply chain | One pinned dependency (duckdb-swift, MIT) and its vendored libraries, all in the SBOM. |
| A.5.34 PII protection | No telemetry, accounts or network. "Data Not Collected". |
| A.8.1 Endpoint devices | Sandboxed; settings enforceable by MDM. |
| A.8.7 Malware | Apple-reviewed, signed, sandboxed, Hardened Runtime; no plug-ins or scripting. |
| A.8.8 Vulnerabilities | Disclosure policy with fix targets; App Store updates. |
| A.8.9 Configuration | Managed preferences. |
| A.8.10 Deletion | Working copies deleted on close and after crashes; memory-only mode. |
| A.8.11 Data masking | Masking by default; truncation to the last four digits. |
| A.8.12 Leakage prevention | Save and export warnings, concealed clipboard, no network. |
| A.8.24 Cryptography | Relies on FileVault at rest; working copies can be avoided entirely. |
| A.8.25 to A.8.29 Secure development | Version control, automated tests of parsing, editing, masking and the engine, pinned dependencies. |
Enforcing settings with MDM
Use a configuration profile (Custom Settings payload) for the preference domain me.expertiseby.tabulay. Enforced settings show as managed and can't be changed in the app.
| Key | Type | Recommended |
|---|---|---|
security.maskCards | Boolean | true |
security.protectClipboard | Boolean | true |
security.warnCardsOnSave | Boolean | true |
security.memoryOnly | Boolean | true on Macs that handle full card numbers |
Reporting a vulnerability
Email security@tabulay.app with steps to reproduce, the Tabulay version (Tabulay ▸ About Tabulay) and your macOS version, in English or French. Also in security.txt.
- Acknowledgement within 3 business days, assessment within 10.
- Fixes: critical within 14 days, high within 30, medium and low in the next release.
- Credit in the release notes, if you want it.
- Good-faith research under this policy won't be pursued legally.
Only the latest App Store release gets security fixes. Never send real card numbers or personal data: use the networks' test numbers.
Other questions: hello@tabulay.app.