Built for trust.

Your core platform data is stored on Supabase EU Central (Frankfurt). Limited data may be processed by sub-processors outside the EU under Standard Contractual Clauses — see our Privacy Policy.

Telltone is designed from the ground up for GDPR. Data minimisation, right to erasure, and lawful processing are built into the platform — not bolted on.

Every table is scoped by workspace. Supabase RLS policies enforce tenant isolation at the database layer — not just in application code.

All connections use TLS 1.3. There are no plain-text endpoints. Certificates are managed and auto-renewed.

Data at rest is encrypted with AES-256 via managed database hosting. Encryption keys are managed by the infrastructure provider under SOC 2 controls.

TOTP-based two-factor authentication is available for all workspace accounts. Enforce 2FA for your team from workspace settings.

Three built-in roles — admin, manager, and member — each with scoped permissions. No one sees more than they need to.

AI conversations processed by Telltone are not used for model training. Your client data is never shared with third-party AI providers for any purpose other than completing the request.

Workspace admin actions will be logged with timestamps and actor identity. Audit log export is on the roadmap for Q3 2026.

Automated daily backups with point-in-time recovery up to 7 days. Backup retention and restoration are managed by Supabase under their business continuity SLA.