Security
Your customers' calls, texts and details run through Tenean. This page says plainly what protects them today, and what is not built yet.
Checked against the product in September 2026.
The short version
Where it runs
Your business's records (customers, conversations, the calendar, jobs and money) are kept in one database in the United States: Supabase's managed Postgres, in Amazon Web Services' US East region in northern Virginia. It is backed up every day.
The web app runs on Cloudflare, which also keeps the files the app stores, such as call recordings.
What protects them
Sign-in and every screen of the Tenean app load only over HTTPS. Type a plain http address and you are sent to the secure one. Older, weaker versions of the encryption protocol are refused, and the iPhone and Android apps will not make an unencrypted connection.
Every record carries the business it belongs to, and the database itself refuses to hand one business's records to another business's login. That rule (row-level security) is on for every table the apps can reach.
An automated test tries to read across two test businesses on every change to the database, and a change cannot merge until it passes. A second test plants a deliberate leak to prove the first would catch it.
Sign in with a one-time link or code sent to your email, with Google or Apple, or with a password of at least 12 characters. The pass that keeps you signed in is replaced every hour.
Owners and staff see only the locations they have been given.
Recordings and photos
Call recordings, voicemails and the photos your customers text you are not public files. The app opens each one through a signed link made for someone signed in to that business, and the link stops working after a few hours. Pictures meant to be seen, like the ones on your website, stay public.
Recording is off until an owner turns it on, line by line, in the phone settings. When it is on, people who call the business hear “This call may be recorded.” before the call is recorded. That notice is on by default and is also the owner's setting.
Voicemails are always recorded, because that is what a voicemail is. Tenean deletes its copy of call and voicemail audio after 90 days; the written transcript stays with the conversation.
The assistant
Replies and call summaries are written with Claude, Anthropic's AI model. Each business chooses whether the assistant's replies wait for approval or send on their own. When someone on your team replies to a customer, the assistant steps back from that conversation. On the phone, it tells callers it is an automated assistant.
Tenean does not take card payments from your customers and does not hold your money. You are paid the way you are today and record the payment in Tenean, so your bank stays your bank.
Not done yet
We would rather you hear it here than find it later.
Report a problem
Email support@tenean.com with “Security” in the subject. Tell us what you found and how to see it, and please give us the chance to fix it before telling anyone else.