EU Only
Azure France Central
AES-256
At rest & TLS 1.3 in transit
OAuth 2.0
Google & Microsoft
Azure
Managed services
Current security and compliance posture
Version 1.1 – April 2026
security@teneks.ai
Teneks provides AI‑powered Live‑Call Assistance and Post‑Call Analysis for sales and customer‑success teams. Data is processed and stored in the EU (Azure France Central with backups in West Europe). Core controls include TLS 1.3 transport security, AES‑256 at rest, RBAC with OAuth (Google/Microsoft), strict logging without PII, and enforced data retention with deletion. This document summarises architecture, controls, and shared responsibilities.
This white paper covers application architecture, data handling, identity and access, logging/monitoring, backup/DR, incident response, and compliance roadmap. It is intended for security reviewers, procurement teams, and legal/privacy stakeholders. Staging and production are separate environments; customer data exists only in production.
sequenceDiagram actor User participant FE as Browser (Front-End) participant WS as WebSocket API (Azure Container Apps) participant BE as App API (Azure Container Apps) participant Blob as Azure Blob Storage (France Central) participant DB as Azure Postgres (Managed) participant L1 as LLM-Lite (Azure Container) participant L2 as LLM-Heavy (Azure Container) User->>FE: Web GUI / OAuth User->>FE: Audio stream FE->>WS: WebSocket audio chunks WS->>L1: real-time guidance WS->>Blob: write raw audio WS->>DB: log endpoint event BE->>L2: batch summary L2->>Blob: read audio, write transcript BE->>Blob: delete raw audio (retention ≤ 30 days)
Production and staging environments are fully segregated in separate Azure subscriptions.
| Stage | Live‑Call Assistance | Post‑Call Analysis |
|---|---|---|
| Ingest | Browser captures mic audio → WebSocket → Container App | Audio file uploaded manually or pulled from customer CRM via HTTPS |
| Process (real‑time) | LLM‑Lite (< 1 B parameters) produces guidance tokens | N/A |
| Store | Raw audio → Blob; endpoint log → Postgres | Raw audio → Blob |
| Process (batch) | LLM‑Heavy summarises & scores after call end | LLM‑Heavy summarises & scores on receipt |
| Delete raw audio | azcopy remove after summary (≥ 30 days default) | Same |
| Persist | Transcript + analytics JSON in Blob & Postgres | Transcript + analytics JSON |
| Class | Examples | Access | Storage | Logging |
|---|---|---|---|---|
| Restricted | Audio, transcripts, analytics derived from conversations | End users in same organisation (role\u2011based); Teneks Founder/CEO (admin/support); designated NDA\u2011bound account manager (if assigned) | Blob + Postgres (EU) | No PII in logs; only IDs |
| Internal | Configuration, anonymised usage metrics (feature usage, page views, session durations) | Teneks operations; org admins where applicable | Postgres | Fully aggregated & anonymised; zero re\u2011identification (Recital 26) |
| Public | Marketing site content | Everyone | N/A | N/A |
Important: Teneks employees do not have access to Restricted data (audio recordings, transcripts or conversation analytics). Only the customer\u2019s own organisation users (per role), the Teneks Founder/CEO and any designated NDA\u2011protected account manager may access Restricted data. Technical infrastructure access is limited to system administrators who can view only anonymised metadata for operational purposes.
Usage data vs. customer content data: For platform improvement we use only fully anonymised and aggregated usage data (how users interact with the platform interface). Customer content data is never used for platform improvement, analytics or shared with third parties.
Application layer logs each authenticated call:
(user_id UUID,
path TEXT,
status_code INT,
activity_time TIMESTAMP,
duration FLOAT)
(user_id, activity_time).| Severity | Remediation target |
|---|---|
| Critical | 72 hours |
| High | 7 days |
| Medium | 30 days |
| Low | 90 days |
| Item | Mechanism | RPO | RTO |
|---|---|---|---|
| Blob Storage | Daily encrypted snapshot → West Europe (GRS) | 24 h | < 12 h |
| Postgres | Azure automated backups (7-day point-in-time) | 5 min | < 2 h |
| Restore test | Next scheduled – Nov 2026 | — | — |
Prompt-injection and jailbreak mitigations are applied and reviewed quarterly. Training and evaluation datasets are governed to avoid sensitive data leakage.
| Control family | Key measures in place |
|---|---|
| A.5 Policies | ISMS & Secure-SDLC policies approved Q2 2025 |
| A.6 Organisation | Role-based access; privileged access JIT; segregation of duties |
| A.8 Asset mgmt | CMDB in Azure; data classification (Public / Internal / Restricted) |
| A.9 Access control | OAuth, least-privilege, quarterly access review |
| A.12 Operations | IaC, automated CI/CD, vulnerability scanning |
| A.13 Communications | TLS, WAF, DDoS protection |
| A.17 Business continuity | DR plan, cross-region backups, incident run-books |
ISO 27001 certification audit planned Q4 2026; SOC 2 Type II scheduled H1 2027.
| Responsibility | Teneks | Customer |
|---|---|---|
| Hosting & patching | ✅ | — |
| Encryption at rest & in transit | ✅ | — |
| Data retention period | Configurable default; enforced deletion tools | Choose & set policy |
| User & role management | — | ✅ (Admins assign roles) |
| SSO / MFA config | — | ✅ (if OIDC configured) |
| Recording consent banner | — | ✅ (display to participants) |
| Incident reporting | 24 h acknowledge | Report incidents affecting credentials |
Security team: security@teneks.ai
© 2025–2026 TENEKSAI OÜ – All rights reserved.