Your sales calls and meetings deserve privacy. Here’s how we keep your data safe inside the EU.
HTTPS everywhere; data at rest encrypted with AES‑256.
All customer data is stored in Azure France Central (EU), with encrypted daily back‑ups in West Europe. AI processing runs in EU regions only (Azure OpenAI France Central, Google Vertex AI EU), with no retention and no training. System emails are delivered via Resend (USA).
OAuth 2.0 / OIDC sign‑in with short‑lived JWT tokens.
Audio 30 days by default, transcripts and analyses per customer policy, both set per workspace. Backups kept 7 days. Access logs up to 2 years. Delete-on-request.
All traffic between your browser and Teneks is protected with HTTPS/TLS encryption. Data stored on our servers is encrypted using AES-256 encryption. We host our platform on Microsoft Azure in the France Central region, which provides built-in security features including DDoS protection. Daily backups are automatically replicated to West Europe for data protection and kept for 7 days.
Transcription runs on our own self-hosted speech model on Azure. Summaries and analyses use Azure OpenAI (France Central) and Google Gemini models through Google Cloud Vertex AI EU endpoints. Both providers are configured with zero data retention: inputs and outputs are not stored, logged or used to train models.
Teneks can automatically detect and mask personally identifiable information (PII) in transcripts. When masking is enabled for a workspace, it is applied to the stored transcript as soon as transcription is complete, so it covers the platform and all exports, not only exported files.
For platform improvements, we use only fully anonymised and aggregated usage data, such as feature‑usage patterns, page views and session durations, that describes how users interact with the platform interface. We never use customer content data (audio, transcripts, conversation analytics) for platform improvement. All usage data is aggregated so that it cannot be traced back to any individual or organisation (GDPR Recital 26).
Users sign in securely using Google or Microsoft accounts through OAuth 2.0. This means we don't store your passwords - authentication is handled by these trusted providers. All API requests are protected with JWT tokens to ensure only authorized users can access your data.
Access to customer content data (audio recordings, transcripts, conversation analytics) is strictly controlled:
Teneks employees do not have access to your audio recordings, transcripts or conversation analytics. Technical infrastructure access is limited to system administrators who can only view anonymised metadata for operational purposes.
Confidential calls: on Meetings and Talent plans, the person who recorded a call can mark it confidential. It then opens only for them. Their manager, your workspace admins and Teneks support cannot open it, and it cannot be shared.
Our application follows secure coding practices and we regularly update dependencies to address any security vulnerabilities. Azure provides the underlying infrastructure security including network protection and access controls.
Platform health is monitored continuously; security alerts are reviewed by an on‑call engineer. We commit to acknowledging any critical vulnerability report within 24 hours, and we notify affected customers of a personal data breach within 48 hours of becoming aware of it.
Our compliance roadmap prioritises EU regulations first, followed by internationally recognised certifications.
| Standard | Status | Target Date | Scope |
|---|---|---|---|
| GDPR | ✅ Operational | Ongoing | Data protection & privacy |
| EU AI Act (limited-risk) | ✅ Aligned | Ongoing | AI transparency & safety |
| ISO 27001 | 🛠️ In preparation | H1 2027 | Information security management |
| SOC 2 Type II | 📋 Planned | Future | Security, availability & confidentiality |
| OWASP Top 10 | 📋 Planned | Future | Application security testing |
| Cyber Essentials Plus | 📋 Planned | Future | Basic cyber security controls |
We use a small number of vetted sub-processors, each bound by a data processing agreement under GDPR.
| Vendor | Service | Data Location | Data Types |
|---|---|---|---|
| Microsoft Azure | Cloud hosting & storage, self-hosted transcription model, Azure OpenAI language models (zero data retention, no training) | France Central (EU); backups West Europe (EU) | All platform data |
| Google Cloud (Google Cloud EMEA Limited, Vertex AI) | Gemini language models for transcript post-processing (zero data retention, no training) | EU regions (Vertex AI EU endpoints) | Transcripts and derived summaries and analyses |
| Stripe | Payment processing | Ireland (EU) | Billing & payment data |
| Resend (Plus Five Five, Inc.) | Transactional email delivery (account emails, coaching and report emails, meeting reminders) | USA (primary processing); sends from the EU region (Ireland). Keeps email content and metadata for up to 30 days in the USA, for delivery and troubleshooting. Transfers under the EU–US Data Privacy Framework and Standard Contractual Clauses | Recipient email addresses and names, email content |
| Google (sign-in) | OAuth authentication | EU regions | Email & profile data only |
| Microsoft 365 | OAuth authentication | EU regions | Email & profile data only |
We notify customers by email at least 30 days before adding or replacing a sub-processor, and customers may object. Customer data is never shared with marketing or advertising platforms.
Sub-processor list last updated: 30 October 2026.
We use Azure Monitor and automated dependency scanning to detect security issues early.
Platform health is monitored continuously; security alerts are reviewed by our engineering team. We commit to acknowledging any critical vulnerability report within 24 hours and will provide customer notification for any incident affecting data security.
Our infrastructure runs on Microsoft Azure with built-in redundancy and backup across two EU regions.
As a growing startup we continue to strengthen our disaster recovery. Azure's managed infrastructure gives us a strong baseline for data protection and service continuity.
The detailed Teneks Security White Paper is not publicly available. It is available upon request for qualified security, procurement, and legal reviews. Contact security@teneks.ai.
Found a vulnerability? Email security@teneks.ai. We'll respond within one business day.
Data protection contact: Arne Niitsoo, data@teneks.ai.