Trust
What you can rely on, and what we do not claim yet.
Tessavra is in development. This page keeps three things apart: what the code and local tests show, what is still being built, and what we do not claim.
- Customer data is separated per organisation by row-level security, tested on a local stack.
- Several controls, including single sign-on and retention, are still in development.
- No certification and no independent penetration test.
Verified in the code and local tests.
Separated per organisation
Row-level security separates customer data per organisation. It has been tested on a local test stack, not in a hosted environment, and there has been no independent penetration test.
Append-only logs
Membership and privileged-access changes are recorded in append-only logs. This is not a log of every administrator or data action.
Private notes kept out of shares
Private notes are excluded from shares, copies and emails. The person who wrote a note can still export their own.
Hidden from screen sharing on macOS
On macOS the Bar and the Panel are excluded from screen sharing, and an organisation can lock the setting. The Workspace window stays shareable, and other capture tools may still show the Bar and the Panel.
Read these with the qualifier
Everything in the list above was checked in code and on a local test stack. No hosted environment has verified any of it yet.
In development.
Single sign-on
A Microsoft Entra single sign-on framework. No identity provider has been connected in a hosted environment.
Roles and entitlements
Role-based access for admin and manager areas, and per-organisation feature entitlements. Tested on a local stack.
Retention and legal hold
A retention policy engine with per-class timers, and a legal hold. Audio expiry exists. Transcripts and insights are not erased by it.
Public meeting share
A revocable link to an AI summary of a meeting, with no transcript. Rate limiting for anonymous visitors has not been verified.
Responsible AI, in development
A person stays in charge.
A finding can carry a review state that a person sets: not reviewed, in progress or reviewed. Where a finding cites audio, the citation carries a confidence marker such as Exact or Unverified. Live guidance in Cortex comes from rules your team writes or passages from your own documents, and no model writes it. Citation accuracy has not yet been evaluated.
- Review states a person sets
- Citation confidence markers
- Guidance your team writes
What we do not claim
No SOC 2, ISO 27001, HIPAA, PCI or GDPR certification. No independent penetration test, uptime commitment or data-residency commitment. No multi-factor authentication, no SCIM directory sync and no SAML sign-in. No self-service data export or erasure, and no default retention period. No public API. No subprocessor list is published.
Documents on request.
Security questionnaires
Send yours and we will answer it for your review.
Review documentation
Ask for the controls described here in a form your team can file.
A person to talk to
Bring your legal, security and compliance teams to a demo.
Talk through the controls you need.
Request a demo and bring the questions from your security review.
Request a demo