How TeklTalk handles your data
What we actually do, stated plainly — including the assurances we don't have yet. Every figure on this page is read from the code that enforces it, so it cannot drift from what the system does.
Last updated 19 August 2026
Your content answers your visitors, and nobody else's
Scoped at the database, not the application
Every retrieval query is restricted to a single project at the database level, and ownership of that project is re-checked on each request rather than trusted from the browser.
Never used for training
Your content is not used to answer another customer's visitors, and it is not sent to a model provider as training data.
Credentials and transport
Passwords are hashed
Stored with bcrypt and never kept in readable form. We cannot see your password, and neither could anyone who obtained the database.
Sessions can't be replayed
Session tokens are stored only as hashes, so a stolen copy of the database could not be used to sign in as you. Session cookies are HTTP-only, same-site, and marked secure in production.
Everything travels over HTTPS
Including the widget on your site and the connection to the database.
We never touch card details
Razorpay handles checkout and holds the card. No card number ever reaches our servers.
Conversations delete themselves
The part of this page we are most confident about, because it is enforced by a job rather than promised in a policy.
The text of a conversation is kept for 7 days and then erased. This runs as a scheduled job every night at midnight UTC, and it counts what remains after each sweep so a purge that silently stopped working would be visible rather than assumed. Sign-in sessions expire after 30 days.
Deleting a project deletes its content, its conversations and its uploaded files. What survives the retention window is counts — how many conversations happened, how much content is indexed — which is what the usage and analytics pages are built from.
Where your data is handled
We rely on a small number of established providers for hosting, storage, models and payments, each for a single job. None of them receive your data for their own purposes, and none are given your content to train on.
Some of those providers run infrastructure in more than one country, so using the service involves processing your data outside the country you are in. The categories of provider we use, and what each category does, are set out in our privacy policy. If you need the specific vendors named for a security review, write to support@tekltalk.com and we will share the list.
What we don't have
We are a small product. These are the questions a security review asks that we would answer no to.
No SOC 2 or ISO 27001
We have not been audited against either standard. If your procurement process requires a certification, we will not clear it today, and we would rather you learn that here than three weeks into a review.
No third-party penetration test
Nobody outside the team has been paid to attack this. We are not claiming the absence of findings as evidence of their absence.
No signed DPA or BAA
There is no data processing agreement to counter-sign, and nothing here is suitable for protected health information.
No SSO or two-factor authentication
Accounts are a password or sign-in with Google. There is no SAML, no enforced MFA, and no role separation within an account.
Found a security problem?
No system is beyond reach, and we will not pretend otherwise. Write to support@tekltalk.com and we will treat it as a priority.