Security
Protecting your data is fundamental to everything we build. Here is how we keep your information safe.
Isolated VM Per Agent
Every agent runs in its own dedicated virtual machine with isolated compute, storage, and networking. No shared processes or file systems between tenants.
Encryption At Rest and In Transit
All data is encrypted in transit using TLS 1.2+ and at rest using AES-256 encryption. Credentials and API keys are stored encrypted in the database and only decrypted at the moment of use.
Workspace-Scoped Data Isolation
Every API request is scoped to the authenticated user's workspace. All database queries enforce workspace and agent ownership checks, preventing cross-tenant data access.
Action-Level Allowlists
Even when an OAuth token grants broad permissions, agents can only perform actions explicitly enabled by the workspace administrator. Deny-by-default, agent-scoped, connection-bound.
Cryptographic OAuth Security
OAuth flows are bound to the initiating user via HMAC-signed state tokens. Callbacks verify the cryptographic signature, preventing session fixation and cross-user authorization hijacking.
Minimal Data Access
When connecting third-party services, we only request the minimum scopes required to perform your requested automations. We never access more data than necessary.
Webhook Signature Verification
Inbound webhooks from third-party services are verified using HMAC signatures or provider-specific signing protocols before processing. Unverified requests are rejected.
Infrastructure Security
Our infrastructure is hosted on SOC 2-compliant cloud providers with private networking between services, automated security patching, and continuous monitoring.
Data Handling
Data obtained from third-party APIs is never used to train AI models. We strictly adhere to all API provider data usage policies, including Limited Use requirements.
Team Security
All team members undergo security training. Access to production systems is restricted, audited, and requires multi-factor authentication.
Penetration Testing
Tensol undergoes regular third-party penetration testing by independent security firms. Test results and remediation status are available upon request for customers undergoing vendor security review. Contact security@tensol.ai for details.
Reporting Vulnerabilities
If you discover a security vulnerability, please report it responsibly by emailing security@tensol.ai. We take all reports seriously and will respond promptly.
Questions?
For any questions about our security practices, please contact us at founders@tensol.ai or review our Privacy Policy.