Skip to main content
This page contains all security controls, privacy practices, and compliance certifications in one place. Use this for vendor assessments, security reviews, and compliance evaluations.

​
Security

​
Encryption & Data Protection

ControlStatusImplementation
Data encrypted in transitImplementedTLS 1.3 for all connections
Data encrypted at restImplementedAES-256 for database, backups, and temporary storage
Encryption key managementImplementedGCP KMS with automatic rotation
Database encryptionImplementedPostgreSQL encrypted connections required, private IP only
Backup encryptionImplementedAES-256, geo-redundant storage, 30-day retention

​
Authentication & Access Control

ControlStatusImplementation
Multi-factor authenticationRequiredSSO via WorkOS with MFA enforcement
Single sign-on (SSO)SupportedSAML 2.0, OpenID Connect
Role-based access controlImplementedLeast privilege, per-resource permissions
Session managementImplemented24-hour expiration, secure token storage
API key securityImplementedScoped permissions, rotation supported
Production access controlsImplementedTime-limited, justification required, audit logged
Password requirementsEnforcedMinimum 12 characters, complexity requirements

​
Infrastructure Security

ControlStatusImplementation
Cloud providerGCPGoogle Cloud Platform, us-central1 region
Multi-zone deploymentImplementedAutomatic failover between availability zones
Network isolationImplementedPrivate VPC, restricted access
DDoS protectionImplementedCloud Armor with rate limiting
Container securityImplementedImmutable infrastructure, automatic patching
Vulnerability scanningAutomatedDependency checks, container image scanning
Infrastructure as codeImplementedVersion controlled, peer reviewed

​
Monitoring & Incident Response

ControlStatusImplementation
Security monitoringActiveGCP Security Command Center, real-time alerts
Application monitoringImplementedError tracking, performance monitoring
Audit loggingImplementedInfrastructure and application changes logged
Failed authentication trackingImplementedSuspicious activity detection
Incident response planDocumentedResponse procedures, escalation paths
Vulnerability disclosureActiveResponsible disclosure, 24-hour acknowledgment

​
Application Security

ControlStatusImplementation
Code reviewRequiredPeer review for all changes
Automated testingImplementedTests required before deployment
Dependency scanningAutomatedVulnerability alerts, prompt patching
Secrets managementImplementedDoppler and GCP Secret Manager
Input validationImplementedAll API endpoints validated
Rate limitingImplementedPer-endpoint and per-user limits
Security headersImplementedHSTS, CSP, X-Frame-Options

​
Edge Security

ControlStatusImplementation
Customer infrastructureYour ControlEdge runs in your environment
Fail-open designBy DesignNever blocks observability data on error
Local rule processingImplementedNo telemetry content sent to control plane
Encrypted communicationImplementedTLS 1.3 for all control plane sync
Deployment flexibilitySupportedSidecar, pipeline, or boundary deployment

​
Self-Hosted Security

ControlStatusImplementation
Self-hosted control planeAvailableComplete infrastructure control
Custom AI providersSupportedUse your AWS Bedrock, Azure OpenAI, or other providers
Air-gapped deploymentContact UsAvailable for enterprise requirements
Network isolationYour ControlDeploy within your security boundary

​
Privacy

​
What We Collect

Data TypeWhat We CollectWhat We Don’t Collect
Account informationName, email, company nameGovernment IDs, social security numbers
AuthenticationSSO tokens, MFA settingsPasswords (handled by your SSO provider)
Telemetry metadataSchemas, field types, volume patterns, quality classificationsLog content, metric values, trace data
Usage dataFeatures used, actions taken in the productIndividual browsing behavior
Billing informationPayment details via StripeCredit card numbers (stored by Stripe)

​
Who We Share Data With

ServiceWhat We ShareWhy
Google Cloud PlatformControl plane data, backupsInfrastructure hosting
Anthropic (default)Telemetry samples, not persistedAI classification
WorkOSUser email, authentication tokensSSO and authentication
StripeBilling information (self-service only)Payment processing for self-service customers
Self-hostedNothing (runs in your infrastructure)Complete data control
See Sub-Processors for complete details.

​
Your Rights

RightHow to Exercise
Access your dataEmail for JSON export
Correct your dataUpdate in account settings or email
Delete your dataEmail (deleted within 30 days)
Export your dataRequest machine-readable export
Object to processingEmail to discuss concerns
Restrict processingRequest limits on specific uses
We respond to all requests within 30 days. GDPR (EU) and CCPA (California) rights are fully supported. Workspace deletion removes all associated telemetry metadata, quality rules, and configurations.

​
Data Retention

Data TypeRetention Period
Account dataWhile your account is active
Telemetry metadataWhile your workspace is active
Quality rulesWhile your workspace is active
Usage analytics2 years
Backups30 days, then permanently deleted
When you delete your account or workspace, data is removed from active systems within 30 days. Backup copies are deleted when backups expire.

​
Data Location

Tero-hosted: United States (GCP us-central1)
Self-hosted: Your chosen region and infrastructure
Edge proxy: Always runs in your infrastructure

​
Privacy Practices

PracticeImplementation
Data minimizationStore metadata only, not log content or metric values
Purpose limitationData used only for documented purposes
Privacy by designArchitecture built to minimize data collection
TransparencyClear documentation of what we collect and why
User controlProgressive access model, self-hosted option available

​
Compliance

​
Certifications & Audits

CertificationTero-Hosted StatusSelf-Hosted Option
SOC 2 Type 22026Your certification applies
Penetration TestingQ1 2025Include in your testing
GDPRCompliantYour infrastructure, your compliance
CCPACompliantYour infrastructure, your compliance
HIPAANot ApplicableYour BAA applies

​
Controls Implemented

Control AreaStatusDetails
Access ManagementImplementedRBAC, MFA required, least privilege, temporary access
Data ProtectionImplementedTLS 1.3, AES-256 encryption, GCP KMS, daily backups
Change ManagementImplementedCode review, staging tests, automated testing, rollback
Incident ResponseImplementedDocumented plan, 24-hour notification, post-incident review
Vendor ManagementImplementedRisk assessment, documented flows, contractual requirements
Security MonitoringImplementedThreat detection, audit logs, vulnerability scanning
Employee SecurityImplementedBackground checks, training, device management, access revocation

​
Data Privacy

RegulationStatusNotes
GDPRCompliantDPA with SCCs available, data subject rights supported
CCPACompliantNo data sales, opt-out supported, processing records maintained
Data ResidencyUS-Central1GCP Iowa region (Tero-hosted), your choice (self-hosted)