Security and data

Client data is used only for your project

Every project’s contract states where data is stored, who can access it and how it is handled afterward.

Defaults

Every project follows these six defaults

Never used for training

Your material and records never train models and are never used for other clients.

Mainland China by default

Servers and models stay in mainland China by default, using registered model services.

You hold the accounts

Models and servers are opened in your name where possible, so billing and access stay with you.

Least privilege

We request only the permissions the work needs, and list the scope in the delivery checklist.

Human approval

External replies, payments and important decisions run only after the owner confirms them.

Return or delete

Within 15 days of the engagement ending, we return or delete data as you choose, and confirm in writing.

Safeguards

Six safeguards

Encryption in transitHTTPS everywhere, with HSTS and a strict content security policy.
Access controlAccess is granted per project; people only see data for projects they work on, under confidentiality duties.
Keys and logsKeys never enter code or logs, and logs never record passwords or tokens.
Account securityPasswords are hashed, deletion requires fresh verification, and you can review and sign out other devices.
BackupsAccount database backups are cleaned up after 30 days; restores re-apply deletions.
IncidentsIf an incident may affect your data, we tell you within 24 hours, with its impact and our response.

Third parties

Third parties we use

Only third parties needed to provide the service, each listed in the data processing agreement.

Services	Purpose	Data location
Tencent Cloud	Servers and verification email delivery	Mainland China
Registered model services in mainland China	Generating answers and running tasks; named per project in the contract	Mainland China
GitHub, Google, Apple	Only when you choose them to sign in to Tenon Account	Handled by the provider

Contracts

Read every clause before signing

Ask for the full text of any of these before signing: email support@tenonai.cn.

Technical services contractScope, delivery targets, acceptance, one-year maintenance and intellectual property.

Data processing agreementPurpose, location, third parties, and return or deletion.

Non-disclosure agreementWhat each side keeps confidential, and for how long.

Report a security issue

Found a security issue in the website, accounts or products? Email support@tenonai.cn and we will reply within 1 business day. Please do not disclose it publicly until it is fixed.

Send a report security.txt

Want to read the contract and DPA first?

Email us and read every clause before you sign.