安全与架构

Last updated 1 October 2026.

Tenuta IQ is in private preview. The public demo contains synthetic data only. Before any organisation puts its own portfolio into Tenuta IQ, we will agree its security, contractual and data-location requirements in writing. This page describes what the software and hosting do today, and lists separately what is planned.

What is in place today

• Hosting: the application runs on Vercel with its functions in Sydney; the database is a Supabase Postgres database in Sydney, Australia. Traffic is served over HTTPS, and data is encrypted at rest by our hosting providers.
• Sign-in without passwords: people sign in with passkeys (Face ID, Windows Hello and similar) or, once email is enabled, a one-time code. Sign-in tokens and sessions are stored only as one-way hashes; sessions expire and can be revoked.
• Separation between organisations: every record carries its organisation, and the database enforces row-level security so one organisation's queries cannot read another's rows.
• Roles and scoped access: people see only what their role allows; outside advisers can be limited to a single lease and portal users to their own agreement.
• Audit trail: changes to leases and related records are recorded with who made them, when and which fields changed; sign-in events and platform changes are logged.
• Abuse protection: sign-in, forms and administrative access are rate-limited.
• Secrets: credentials are held in the hosting provider's encrypted environment settings, not in the code.
• Backups: the database is backed up by Supabase on its standard schedule.

Planned before production onboarding

• Agreed data location for each customer, with regional hosting outside Australia where required
• Single sign-on (SAML or OpenID Connect) for customer staff
• Documented recovery objectives and a tested restore procedure
• Independent security testing
• A formal information security programme; Tenuta IQ holds no security certifications (such as ISO 27001 or SOC 2) today
• A published list of the service providers that process customer data

AI document processing

AI-assisted extraction of lease documents is in development and is not active in the demo. When it is, extracted values will be proposals with the page they came from, which a person must accept before they become part of the record, and customers will be told which providers process their documents.

Reporting a vulnerability

If you believe you have found a security issue, please tell us through our contact form, starting your message with "Security". Please do not access data that is not yours or disrupt the service while testing.