Tendrl
Security
What we do to protect your devices, workflows, and data, stated plainly.
Encryption in transit
Everything between you, your devices, and Tendrl travels over TLS. The dashboard and APIs are HTTPS only. Devices connect to the MQTT broker over TLS on port 443 and verify the server's certificate. The MicroPython SDK ships the certificate roots a board needs, and a board that can't verify certificates fails closed instead of connecting insecurely.
Our servers accept traffic on two ports only: 443, and 80, which exists only to redirect to HTTPS and renew certificates.
Encryption at rest
The platform database is stored on an encrypted volume. Files you store with us, such as camera clips and transferred files, live in Amazon S3, which encrypts every object at rest. API keys and access tokens are stored encrypted, and passwords are stored only as hashes.
Credentials you save on a Strand connector are never sent back out: the API, the editor, and workflow exports all return them redacted.
Isolation between accounts
Each account's data is separated by Postgres row-level security, enforced by the database itself. Our services connect as a restricted role that can only see the rows of the account making the request. So a query that forgot to filter by account would still return nothing from anyone else's account.
Data that never reaches us
- Provisioning a board. When you flash or provision a device from the browser, the API key, Wi-Fi password, files, and camera frames go from the browser tab straight down the USB cable. They don't pass through our servers, and we don't store your Wi-Fi password.
- Surface scans. We keep a record of each scan (hash, verdict, indicators found) but not the file or payload you scanned, and scanned content is never used to train models. The local scanner analyzes files on your own machine and, by default, sends us nothing about them.
Where your data lives
Tendrl runs on Amazon Web Services in the us-east-1 (N. Virginia) region, in the United States. The tendrl.com website and documentation are served by Cloudflare. Payments are handled by Stripe; we never see or store card numbers.
Who can reach production
No SSH port is open to the internet. Staff access to servers goes through AWS Systems Manager, which requires our AWS credentials and logs each session. Servers get short-lived credentials from AWS rather than long-lived keys in configuration files.
How long data is kept
History is deleted automatically once it is older than your plan's window. Downgrading applies the new plan's window from then on.
| Product | What's kept | Free | Starter | Standard | Pro |
|---|---|---|---|---|---|
| Contact | Message history | 7 days | 30 days | 90 days | 180 days |
| Strand | Run history | 7 days | 30 days | 90 days | 1 year |
| Surface | Scan history | 7 days | 30 days | 90 days | 1 year |
Account and configuration data is kept while your account is active. When you delete your account, its data is deleted across all three products at that moment, and it can't be undone. The exceptions are billing records held by Stripe and anything we are required by law to keep. See the Privacy Policy for the full picture.
Reporting a vulnerability
If you find a security issue, email [email protected] with "Security" in the subject. Include what you found, how to reproduce it, and what an attacker could do with it. We'll acknowledge it within 2 business days and keep you updated until it is fixed.
While you look, please test only against your own account, don't access or change other people's data, and don't run denial-of-service or social-engineering tests. We don't run a paid bug bounty.
