Security at Tenmon

Hosting and data residency

Tenmon runs entirely on Google Cloud Platform using a serverless architecture. All customer data is stored and processed in United States regions, and we do not move customer data outside US regions.

Encryption

• In transit: all connections to and within Tenmon use TLS.
• At rest: all stored data is encrypted at rest.

Tenant isolation

Tenmon is multi-tenant. Each customer's data is isolated at the database layer using PostgreSQL row-level security, so one customer can never access another's data.

Integrations and access

You connect Tenmon to your own tools, and you control the scope of access you grant:

• GitHub — Tenmon ingests repository activity (pull requests, reviews, comments, pushes) through cryptographically verified webhooks. For read/write features, you install the official Tenmon.ai GitHub App and choose exactly which repositories it can access; within those repositories, Tenmon can read from and write to your code to support agent workflows. Access uses short-lived tokens issued by GitHub on demand, and Tenmon does not store long-lived repository tokens.
• Linear — Tenmon ingests issue, comment, and project activity through cryptographically verified webhooks. You connect Linear by authorizing the official Tenmon Linear app, which requests read-only access to your workspace. Tenmon stores the resulting credentials encrypted on its servers and never sends them to your browser. You can disconnect at any time, which revokes Tenmon's authorization in Linear and removes the stored credentials.
• Slack — Tenmon posts summaries and notifications to a channel you designate, including a private channel where you have invited Tenmon. When you designate a public channel, the channels:join scope lets Tenmon add itself to that channel so delivery works without a manual invite; it cannot post to channels it has not joined. The groups:read scope is used only to expose metadata for invited private channels; Tenmon can neither enumerate nor join private channels it has not been invited to, and does not read your Slack messages.
• Public contact form — The unauthenticated /contact page collects the name, work email, company, and any optional agent count or message you submit, then forwards it to a Tenmon-managed Slack incoming webhook so our team can respond. This is separate from customer Slack integrations and does not read or write to customer Slack workspaces. The route does not persist a separate copy in Tenmon's application database; the Slack copy is subject to the receiving workspace's retention settings, which the contact route does not set or inspect.

The GitHub, Linear, and customer Slack connections are your systems. You can disconnect any of those integrations at any time, which removes Tenmon's access and clears the associated configuration and secrets.

Payments

Subscriptions and payments are handled by Stripe. Tenmon never stores, processes, or transmits your payment card details — card information is entered directly with Stripe. We only keep your subscription plan and status.

Monitoring, logging, and access controls

We log application and security events to support reliability and incident response. Access to logs and production systems is restricted to authorized personnel through least-privilege controls, with break-glass procedures for incidents. Security and audit logs are retained on a defined schedule, and operational logs for a shorter window.

Compliance

We are pursuing SOC 2 Type 2 certification, targeted for late 2026. We are not yet certified; the administrative, technical, and physical controls described on this page form the foundation of that program.

Subprocessors

We use a small set of trusted subprocessors to operate Tenmon. GitHub, Linear, and customer-configured Slack are integrations with your own systems, not Tenmon subprocessors, and are not listed here. The public contact form uses a separate Tenmon-managed Slack destination; its subprocessor classification and retention terms remain subject to final legal and security review.

Reporting a vulnerability

If you believe you've found a security issue, please email security@tenmon.ai. We investigate all legitimate reports and appreciate responsible disclosure. Please give us a reasonable opportunity to address an issue before disclosing it publicly.