Security & Data Protection

• Managed cloud infrastructure with provider-level physical and network security controls.
• Segregated environments for development, staging, and production.
• Infrastructure changes made through reviewed, version-controlled deployments.

• Data encrypted in transit using TLS.
• Data encrypted at rest by the underlying managed storage services.
• Secrets and API credentials stored in a managed secret store, not in application code.

• Role-based access within customer accounts.
• Least-privilege internal access, granted by business need and reviewed periodically.
• Multi-factor authentication required for administrative access to production systems.
• Access revoked promptly when personnel change roles or leave.

Customer data is logically separated, and application authorization rules restrict each account to its own records, documents, and communications history.

• Application and infrastructure logging with retention appropriate to the system.
• Automated alerting on availability and error conditions.
• Dependency and vulnerability scanning in the development pipeline.

• Automated database backups with point-in-time recovery where supported.
• Periodic restore testing.
• Documented recovery procedures for production outages.

TenLease maintains an incident response process covering detection, containment, investigation, remediation, and customer notification. Where a security incident affects customer data, TenLease will notify affected customers without undue delay and provide the information available at the time.

TenLease uses third-party providers for hosting, communications delivery, AI processing, analytics, and payments. Providers are selected for their security posture and are bound by contractual confidentiality and data protection terms.

• Customer data is retained for the life of the account and for a limited period afterward.
• Customers may request export or deletion of their account data.
• Backups age out on their own schedule after deletion from production systems.

Report suspected vulnerabilities to jeff@tenlease.ai. Please include enough detail to reproduce the issue. We ask that you avoid accessing or modifying other users' data while testing.