Security at Telene

1. Our approach

Telene aims to make careful security choices, limit unnecessary access, and communicate honestly about current safeguards and limitations.

Security is a shared responsibility. Telene provides application and infrastructure controls, while users remain responsible for choosing appropriate information, protecting their accounts, managing organization access, and controlling anything they share or export.

No internet service can promise absolute security. This page does not create a guarantee that an incident, loss, interruption, or unauthorized access can never occur.

2. Private-beta limitations

Telene Grid is still being tested. Features, limits, infrastructure, and controls may change, and interruptions or defects may occur.

During private beta, do not upload children’s data, regulated health information, payment-card information, authentication secrets, classified information, high-risk government identifiers, or other information prohibited by the Terms of Service.

Telene may maintain backup and recovery copies for disaster recovery and service restoration, but these do not replace users’ own source files and independent copies. Backup coverage and recovery capabilities may vary during private beta.

Keep your original source files and independent copies of important work. Do not rely on Telene as the sole repository for information you cannot afford to lose.

3. Infrastructure and service providers

Telene currently uses:

• Cloudflare Pages for website and application delivery
• Cloudflare Workers for production API infrastructure, network and security services, rate limiting, and operational logging
• Cloudflare Hyperdrive to connect the application API to PostgreSQL
• Cloudflare R2 for certain large dataset objects and feedback screenshots
• Supabase for PostgreSQL database services and authentication; the primary database is currently hosted in Oregon, United States
• Sentry for browser error and performance monitoring
• ZeptoMail for automated transactional account email
• Zoho Mail for Telene’s business, privacy, and security correspondence
• Google and Microsoft when a user chooses to connect a supported account

Telene may retain a secondary application deployment on Railway for operational rollback or recovery. Normal production API traffic is served through Cloudflare Workers.

These providers operate their own infrastructure and security programs. Their involvement does not mean that every item of information remains exclusively in Oregon.

4. Secure transport

Official Telene website, application, and API endpoints use HTTPS to protect information while it moves between the browser and Telene’s services.

Users should access Telene only through official telene.app HTTPS addresses. HTTPS protects data in transit but does not protect information after a user downloads, copies, exports, or shares it outside Telene.

5. Authentication

Password authentication is handled through Supabase Auth. Telene does not store your plaintext account password.

Telene may also support authentication through Google or Microsoft. Those providers authenticate the user and return limited authentication information to Telene; Telene does not receive the password for the connected provider account.

Users must protect their login methods, email accounts, devices, recovery methods, and active sessions. Telene will never ask a user to email a password or access token.

6. Browser sessions and local information

Telene stores authentication and session information in browser local storage. IndexedDB may contain complete dataset working copies, unsaved local datasets, workspace drafts, and related application state.

Anyone with access to an unlocked device or browser profile may be able to access locally stored information or an active Telene session. On a shared or untrusted device, sign out, close Telene tabs, and clear site data when finished.

Clearing site data may permanently remove unsaved drafts or working copies. Export anything you need before clearing it.

7. Organization isolation and authorization

Telene uses organization_id as the tenant boundary. Server-side authorization checks are intended to restrict queries and changes to the authenticated user’s organization and permitted role.

Organization owners and administrators may have broader authority than ordinary members, including the ability to manage membership or resources. Permissions and ownership checks are applied to protected operations.

Organizations are responsible for inviting appropriate users, assigning suitable roles, removing access when it is no longer needed, and supervising activity performed on their behalf.

8. Dataset access and storage

Datasets are private to the applicable user or organization unless an authorized user deliberately shares results through a Workspace Share or exports information outside Telene.

Dataset content may be stored inline in PostgreSQL or, for certain larger datasets, as an object in Cloudflare R2 with related records in PostgreSQL. Server-side checks govern access to stored dataset records and objects.

Telene does not ordinarily inspect uploaded dataset contents for general product research. Access may occur when reasonably necessary for user-requested support, service operation, debugging, security or abuse investigation, legal compliance, or protection of users and Telene. Where practical, Telene seeks to use controlled metadata and user-provided details instead of raw contents.

9. Workspace access

Saved workspaces are protected by account, organization, role, visibility, and creator-based rules as applicable. A user’s ability to view a workspace does not necessarily grant permission to edit, share, delete, or permanently delete it.

Workspace content may refer to datasets that have separate permissions or lifecycle states. Moving a workspace to Trash makes its active Workspace Shares unavailable. Restoring a workspace does not automatically reactivate those shares.

10. Workspace Share security

A Workspace Share is a frozen snapshot, not direct access to the editable workspace. It may use an unlisted bearer link or password-protected access and may have an expiration.

Anyone who possesses an unlisted link may be able to open it. For a password-protected share, the person creating or distributing it must keep both the link and password under appropriate control.

Workspace Share passwords are stored as salted scrypt hashes rather than plaintext and are checked using timing-safe comparison.

Cloudflare rate limiting is applied to attempts to open a Workspace Share, including password verification attempts. The current limit is applied per share token rather than per user or IP address.

Rate limiting reduces certain forms of repeated access attempt; it does not make a weak password safe or prevent a valid link or password from being forwarded.

Revocation or expiration prevents further access through Telene, but cannot recall information already downloaded, copied, photographed, printed, screenshotted, or otherwise retained by a recipient.

11. Aggregate and row-level share controls

Workspace Shares use aggregate results by default. A user must deliberately enable individual observations or row-level results and acknowledge the related warning before including them.

The current share sanitizer applies minimum-count protections to certain outputs: certain grouped summaries and binned results with fewer than three observations are excluded. These protections do not apply universally to every possible result and must not be treated as a guarantee of anonymity.

Aggregate information may still reveal sensitive facts when groups are small, categories are unusual, or recipients combine results with other information. The person creating a share is responsible for reviewing the snapshot, selecting an appropriate access method, and sharing it only with suitable recipients.

12. Google and Microsoft connections

Google and Microsoft connections use OAuth authorization and PKCE. Telene requests access only when a user chooses to connect a supported service.

Stored Google and Microsoft refresh credentials are encrypted before storage. Short-lived access tokens may be used to retrieve authorized files or information during an active connection.

Users should disconnect a provider when the connection is no longer needed and may also revoke Telene’s access through the provider’s own account settings. Disconnecting a provider does not delete information already imported into Telene or the original file held by Google or Microsoft.

13. Application and network controls

Current controls include server-side validation and authorization, organization-bound resource access, controlled error handling, selected HTTP security headers, request and upload limits, Cloudflare network protections, and rate limiting on selected sensitive operations.

A Content Security Policy is not currently presented as an implemented Telene control. Selected security headers and rate limits do not prevent every application, browser, credential, or abuse risk.

14. Secrets and privileged credentials

Backend secrets and privileged service credentials are kept in server-side environment or provider configuration rather than public frontend code. Public browser configuration is limited to values intended for browser use.

Access to administrative or service credentials is intended to be limited to what is reasonably needed to operate, secure, investigate, or recover the service. Users must never place passwords, access tokens, private keys, or other authentication secrets inside datasets, workspace content, feedback, or support messages.

15. Monitoring, telemetry, and logs

Telene uses first-party operational telemetry, service logs, and Sentry browser monitoring to understand errors, performance, reliability, security events, and use of selected features.

Telemetry is restricted to controlled metadata and allowlisted values, but should not be assumed to be anonymous. It may be associated with account, organization, project, dataset, workspace, session, or request identifiers.

Telene’s logging rules are intended to exclude dataset names, filenames, column names, cell values, report content, signed URLs, authorization headers, cookies, and request bodies. Users should avoid placing sensitive information in fields that may appear in errors or support communications.

16. Access to Customer Content

Telene does not manually review uploaded datasets as part of ordinary operations and does not use customer datasets for advertising or AI-model training.

Limited access to Customer Content may be necessary for user-requested support, service maintenance, debugging, security or abuse investigation, legal compliance, or data protection and recovery work. Telene seeks to limit access to the purpose and information reasonably needed.

Do not send unnecessary dataset contents through email or feedback. If support requires content access, share the smallest suitable example and remove or replace confidential values where possible.

17. Deletion safeguards

Permanent dataset deletion is designed to remove inline data from the active PostgreSQL database and associated objects from active Cloudflare R2 storage. If a required active R2 object cannot be deleted, Telene does not report the permanent deletion as complete.

Moving a workspace to Trash revokes its active Workspace Shares. Permanently deleting a workspace removes its records and Telene-hosted share snapshots from active product systems through the applicable database relationships.

These safeguards govern deletion from active product systems. Residual copies may remain temporarily in backup or recovery systems according to the applicable retention process.

Deletion actions require applicable permission and ownership or administrative authority. Account deletion during private beta requires manual identity and authority verification.

See the Data Deletion page for further details and limitations.

18. Backups and recovery

Telene may maintain periodic backup and recovery copies for disaster recovery, business continuity, and service restoration. Backup coverage, frequency, retention, and recovery capabilities may vary as the private beta develops.

Backups may include database records and stored dataset objects. Backup copies are maintained separately from active product systems where practical and are not intended as a user-accessible backup, archive, version-history, or individual-item restoration service.

Telene does not guarantee that a particular dataset, workspace, account, version, or individually deleted item can be restored.

A secondary application deployment, if retained, supports application rollback or recovery. It is not a Customer Content backup and does not guarantee that Customer Content can be restored.

Users must keep original source files and independent copies of important information. Do not rely on Telene as the sole repository for information you cannot afford to lose.

19. Your security responsibilities

Please help protect your account, organization, and information:

• use a strong, unique password and protect your email account
• do not share passwords, session tokens, or connector credentials
• sign out and clear site data on shared or untrusted devices
• invite only trusted organization members and review their roles
• remove access promptly when a person no longer needs it
• review each Workspace Share before distributing it
• use a strong, separately communicated password when share protection is appropriate
• revoke shares and connected services when no longer needed
• do not upload information prohibited during private beta
• retain original files and independent copies of important work
• report suspected compromise or security issues promptly

20. Security incidents

If Telene becomes aware of a security incident, we will investigate, take reasonable containment and remediation steps, preserve appropriate records, and notify affected users or authorities when required by applicable law.

The timing and content of any notice will depend on what is known, the nature and scope of the incident, legal requirements, the needs of the investigation, and steps needed to avoid increasing harm.

If you believe your account or organization may be compromised, contact security@telene.app promptly and include only the information reasonably needed to understand the concern.

21. Responsible disclosure

If you believe you have found a Telene security vulnerability, please email security@telene.app with a clear description, affected URL or feature, reproduction steps, and potential impact.

Please act in good faith. Do not access, retain, alter, delete, download, or disclose information that does not belong to you. Do not perform denial-of-service, destructive, automated high-volume, social engineering, physical, or third-party infrastructure testing.

Stop testing and report the issue if you encounter another person’s information, authentication material, or a risk of service disruption. A report does not create a right to payment, employment, or a particular response time unless Telene has expressly agreed otherwise in writing.

22. Certifications and independent assurance

Telene does not currently claim SOC 2, ISO 27001, PCI DSS, HIPAA, or another independent security certification or regulated-data compliance status for Telene Grid.

The use of established infrastructure providers does not transfer all of their certifications or assurances to Telene. Users whose requirements depend on a particular certification, audit, contractual security schedule, data location, or regulated processing commitment should not assume it is available during private beta.

23. Changes to this page

Telene’s security practices will evolve as the beta develops. We may update this page to reflect new controls, providers, risks, or operational experience.

We will not describe a planned security, backup, recovery, or compliance capability as currently available before it has been implemented. Material changes will be reflected by updating the version or effective date and, where appropriate, by providing additional notice.

24. Contact us

For vulnerability reports or security concerns:

security@telene.app

TELENEER

Owned and operated by G B SOUNDAR SRIRAM

Thanjavur, Tamil Nadu, India

Privacy and deletion requests: privacy@telene.app

General questions and support: hello@telene.app

Do not send passwords, access tokens, prohibited sensitive information, or unnecessary dataset contents by email.