Security

How your data is handled

• Your conversationsStored against your account so Tessen can remember them, and readable only by you. Signed out, nothing is written down at all — an anonymous conversation leaves no record once the tab closes.
• Memory is yours to removeEverything Tessen has remembered about you is listed in Settings, item by item, and each one can be deleted. Nothing is remembered that you cannot see.
• API keys are stored as hashesOnly a SHA-256 hash of a key is kept. The key itself is shown once, at creation, and cannot be recovered afterwards — by you, or by us.
• A key cannot escalateAn API key can never mint another key, and never exercises a person's data rights: export, erasure and consent changes all require a signed-in human. A leaked key cannot lock you out of your own account or delete it.
• Sandbox keys cannot reach real dataA sandbox key authenticates as a separate account. Your first integration test cannot run against your customers, because the credential it uses has no path to them.
• Webhook destinations are re-checked after DNSA URL that looks external can still resolve to an internal address. Destinations are validated again after resolution, and a single private answer is enough to refuse.
• Deletion actually deletesAccount erasure removes your data rather than flagging it. Three separate schema constraints used to make full deletion impossible; each was removed, and the behaviour is covered by tests that exercise an account which has actually used the product.
• Encryption in transitEvery Tessen surface is served over TLS, and internal service-to-service calls carry short-lived signed assertions rather than forgeable headers.

What we have not done

A security page is easy to write dishonestly, because nobody reading it can check. This section is what makes the rest of it worth believing.

• Tessen has no SOC 2, ISO 27001 or equivalent certification. We have not begun an audit, and we will say so here when we do.
• There has been no third-party penetration test.
• There is no customer-managed encryption key option, and no self-hosted deployment.
• Single sign-on for teams is not available yet.

Reporting something

If you believe you have found a vulnerability, write to [email protected]. Tell us what you found and how to reproduce it. We will confirm receipt, and we will not pursue anyone who reports in good faith and does not access or destroy other people’s data while investigating.

There is no paid bounty programme yet. Saying so is fairer than implying one.