Security & data
Security, stated plainly.
What is in place, what is ready for every pilot workspace and what TellStay does not hold. If it isn’t on this page, don’t assume it.
Controls
Where we stand today.
Status as of October 2026. We update this page when a status changes.
Workspace isolation
Every record belongs to one workspace, every query is scoped to it, and automated tests check that scoping on every change.
Read-only connections
Every connector is read-only: CRM, support desk, call transcripts, email, Slack and Teams. TellStay never writes back to your systems.
Free text left out
Salesforce free-text fields are excluded at ingestion, which keeps notes and personal detail out of TellStay.
AI off for pilot data
AI features are off by default. For pilot data they stay off until our AI provider confirms zero data retention in writing.
Admin audit log
Admin actions in a workspace are recorded in an audit log.
Encryption
Data is encrypted in transit with TLS and at rest by our cloud and database providers.
Deletion and purge
Deletion on request or at the end of a pilot, confirmed in writing. Full workspace purge is built and tested, with a cooling-off period and a typed confirmation, and leaves only a content-free deletion record.
Backups and restore
Every pilot workspace is covered by production backups with a tested restore.
Data processing agreement
A DPA is available to pilot partners and is signed before any data flows. It lists our subprocessors.
SOC 2 and certifications
TellStay does not hold a SOC 2 report or any security certification today. Bring your security questionnaire and we answer it in full.
AI and your data
AI is opt-in, bounded and cited.
TellStay is useful with AI turned off. Scores, the Renewal Room and reports don’t depend on it.
- Off by default. An admin turns it on per workspace.
- Off for pilot data until zero data retention is confirmed in writing.
- Only a bounded set of signals is sent, never your whole CRM.
- Customer text is treated as data, never as instructions.
- AI never computes scores and never sends anything on its own.
Pilot default: AI off
During the pilot, every score, the Renewal Room and share reports work without AI. Briefs switch on only after the written confirmation and your admin’s say-so.
Subprocessors and DPA
Who touches your data.
The providers we use to run TellStay. The DPA, signed before any pilot data flows, is the authoritative list.
| Provider | Used for | When |
|---|---|---|
| Google Cloud and Firebase | Hosting, authentication | Always |
| Neon | Managed Postgres database | Always |
| Nango | Salesforce connection (OAuth) | When Salesforce is connected |
| Anthropic | AI briefs | Only if AI is turned on |
Security review welcome.
Bring your security questionnaire to the pilot fit call. We answer every question in full, including what TellStay does not hold.