Security and data
Client data is used only for your project.
Where data lives, who can access it and what happens when we are done: written down for every project, and into the contract.
Defaults
Every project starts from these six.
Never used for training
Your material and records never train models and are never used for other clients.
Mainland China by default
Servers and models stay in mainland China by default, using registered model services.
You hold the accounts
Models and servers are opened in your name where possible, so billing and access stay with you.
Least privilege
We request only the permissions a use case needs, and list the scope in the delivery checklist.
People confirm
External replies, payments and important decisions run only after the owner confirms them.
Return or delete
Within 15 days of the engagement ending, we return or delete data as you choose, and confirm in writing.
Safeguards
The safeguards we apply.
- Encryption in transitHTTPS everywhere, with HSTS and a strict content security policy.
- Access controlAccess is granted per project; people only see data for projects they work on, under confidentiality duties.
- Keys and logsKeys never enter code or logs, and logs never record passwords or tokens.
- Account securityPasswords are hashed, deletion requires fresh verification, and you can review and sign out other devices.
- BackupsAccount database backups are cleaned up after 30 days; restores re-apply deletions.
- IncidentsIf an incident may affect your data, we tell you within 24 hours, with its impact and our response.
Third parties
Services we use.
Only third parties needed to provide the service, each listed in the data processing agreement.
| Service | Purpose | Data location |
|---|---|---|
| Tencent Cloud | Servers and verification email delivery | Mainland China |
| Registered model services in mainland China | Generating answers and running tasks; named per project in the contract | Mainland China |
| GitHub, Google, Apple | Only when you choose them to sign in to Tenon Account | Handled by the provider |
Contracts
Read every clause before signing.
Ask for the full text of any of these before signing: email support@tenonai.cn.
Report a security issue
Found a security issue in the website, accounts or products? Email support@tenonai.cn and we will reply within 1 working day. Please do not disclose it publicly until it is fixed.
Want to read the contract and DPA first?
Email us and see every clause before you sign.