Security

Encryption

All data in transit is encrypted with TLS. The database and file storage are encrypted at rest by their providers. Production secrets are held in the hosting platform’s encrypted configuration and are write-only once set.

Tenant isolation

Every workspace record carries a workspace identifier, and every database query is scoped to the requesting workspace. Cross-tenant access is treated as a defect of the highest severity, tested for in the automated suite, and the first thing we ask security researchers to look for.

Access control

• Role-based access within each workspace (Owner, HR, Manager, Person), enforced on the server for every mutation.
• Feature-level permissions that an Owner can delegate, with anti-privilege-escalation rules on invitations: nobody can invite or promote above their own role.

AI data handling

Where the assistant retrieves workspace data to answer a question, a server-side filter removes compensation, government identifiers, medical information, personal contact details and credentials before anything is sent to a model provider. Features that process content a user supplies directly — résumé parsing, document summarisation, roster import, job drafting — transmit that content as given. AI usage is rate-limited and metered per workspace.

Surveys

Responses to surveys marked anonymous are stored without respondent identity. A keyed one-way hash is used solely to prevent duplicate responses.

Auditability

Administrative and data-changing actions are recorded in a per-workspace audit log.

Backups and recovery

The production database keeps point-in-time recovery, and the production branch is protected against deletion. Customers can export a full workspace in a machine-readable format and permanently delete a workspace themselves, with cascading removal of all its records.

Development practice

Changes are made through version control. Automated type, unit, end-to-end and dependency-vulnerability checks are run against a change before it is deployed.

Incident response

tethr will notify affected customers without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting their data, with what is known about its nature, scope and the measures taken (DPA §8).

Reporting a vulnerability

Please report vulnerabilities privately through GitHub private vulnerability reporting rather than a public issue. Include what you found and where, steps to reproduce, and the impact you believe it has. Do not access, modify or exfiltrate data belonging to any workspace while investigating; use the demo workspace. We will acknowledge the report, investigate, and keep you informed, and we ask for reasonable time to remediate before public disclosure.