Security controls
The Security page describes the customer-facing safeguards for document intake, workspace access, evidence, activation, retention, and deletion.
What we publish about handling your documents.
Start with the maintained public policies, processor record, legal terms, and reporting contacts below. Deployment-specific architecture, control evidence, assurance scope, and questionnaire responses are provided through a qualified review. The self-service terms and processing addendum are published as versioned documents, identified by the same hash an acceptance receipt records.
This page answers one question: what is published about security and document handling, and where to request a qualified review. How a citation stays bound to its source is on Evidence. What a result has to carry before it is published as a number is on Benchmarks. The frozen fixtures you can rerun are on Reproducibility. Our research and its measured results are on Research.
Customer names, figures and logos appear on this site only with that customer’s written sign-off on the exact wording.
The pages
Security
The customer-facing safeguards for document intake, workspace access, evidence, activation, retention, and deletion.
Privacy notice
What is collected, why it is processed, where it is stored, which processing happens outside Korea, and how to ask for access, export or deletion.
Subprocessors
Every third-party service permitted to process account, document, billing or inquiry data, with the purpose and the data class for each one.
Service status
Public availability and incident notices for the service.
Terms
The self-service terms a workspace owner accepts, and the service operator.
Security contact
security@tavonel.com for a vulnerability, privacy@tavonel.com for a data request, and the inquiry form for a security review.
security.txt
The machine-readable disclosure record: reporting address, policy and preferred languages, at the well-known path.
Processing addendum
Version 2026-09-30, accepted by a workspace owner together with the self-service terms. It states the breach-notification and sub-processor change commitments, the verified-request deletion right, the configured deletion periods, and the qualifications that apply to legal retention duties and provider backups.
Earlier data processing agreement: Archived draft v2 (2026-09-23) — replaced by the 2026-09-30 processing addendum for a workspace that accepts it, and kept as the template for negotiating a separately executed Enterprise agreement. It is not a signed agreement..
Public trust resources
Privacy notice
The privacy notice explains the data categories, purposes, storage and transfer locations, retention, and verified access, export, and deletion requests.
Subprocessors
The subprocessor record names the third parties permitted to process customer data, their purpose, the data class, and the applicable location information.
Data processing agreement
The 2026-09-30 processing addendum is the data processing agreement a workspace owner accepts with the self-service terms. An Enterprise engagement can negotiate a separately executed agreement from the archived 2026-09-23 draft.
Responsible disclosure
The reporting address and disclosure policy are published at the standard security.txt location.
Qualified security review
Deployment-specific architecture, control evidence, assurance scope, and questionnaire responses are provided through an appropriate qualified review.
What is in place, what is coming, and what is absent
Every row below is already stated on the page it links to. This is the same record in the order a security review asks for it. 10 in place · 1 on the roadmap · 8 absent.
| What a reviewer asks for | State | What is true today |
|---|---|---|
| Encryption in transit | Provided | Traffic is encrypted in transit throughout. Security |
| Encryption at rest | Provided | Stored objects are encrypted at rest by the storage provider, and service credentials remain on trusted server boundaries. Security |
| Workspace isolation | Provided | Identity and workspace membership are resolved server-side, and data access is scoped to the authenticated workspace and rechecked at protected operations. Security |
| Subprocessor record | Provided | Every third party permitted to process account, document, billing or inquiry data is named with its purpose, the data class and the region it is configured to process in. Thirty days' notice of an addition or replacement, with an objection right, is written into the processing addendum. Subprocessors |
| Personal data breach notification | Provided | Without undue delay and no later than 72 hours after becoming aware, with the nature and likely effects, the affected data categories, the measures taken or proposed and a contact point, and missing information supplied as it becomes available. Processing addendum (2026-09-30) |
| Deletion on a verified request | Provided | On a verified deletion request, or on termination, the scope and outcome are confirmed in writing, and compiled worlds can be exported as signed packages first. Affected material becomes eligible for physical purge 30 days after the verified request, and immutable artifacts carry a 28-day recovery protection from creation. These are configured periods, not a guaranteed completion deadline. A request may be limited or delayed by a legal hold or retention duty. Privacy notice |
| Restore drill | Provided | One drill is on record: on 2026-09-10 the production database was restored from its 2026-09-08 backup into a separate temporary project, the catalog of the original and the restored copy matched on all 431 objects, and the temporary project was deleted. It covered the database. It did not cover the document bytes in object storage, a full service recovery, or a run through the customer-facing application, and the receipt is available to a customer on request. Enterprise DPA template (archived draft) |
| Data processing terms | Provided | The 2026-09-30 processing addendum becomes part of the self-service agreement when a workspace owner explicitly accepts it, and the acceptance records the version and the hash of each document. It does not execute standard contractual clauses. A transfer that needs them is agreed before the affected data is submitted. Processing addendum (2026-09-30) |
| Responsible disclosure | Provided | The reporting address, the policy and the preferred languages are published at the standard well-known path. security.txt |
| Architecture, control evidence and questionnaire responses | Provided | Deployment-specific architecture, control evidence, assurance scope and questionnaire responses are provided through a qualified review rather than published here. Contact |
| Separately signed data processing agreement | Roadmap | Negotiated for an Enterprise engagement during scoping, starting from the archived 2026-09-23 draft, which is a template and not a signed agreement. No signed bilateral agreement exists until both parties execute one. Once executed, the signed agreement prevails within its scope. Enterprise DPA template (archived draft) |
| Customer-managed encryption keys | Not provided | Encryption at rest is the storage provider's. There is no customer-managed key. Processing addendum (2026-09-30) |
| Roles, single sign-on and a seat model | Not provided | Access control is a workspace membership checked server-side on every request. The account that owns a workspace is the account that reaches it, and source-level access is enforced at the grain of the workspace rather than the member. Enterprise DPA template (archived draft) |
| Contractual data residency | Not provided | The database and the serverless functions are configured for Seoul and the object bucket carries an Asia-Pacific location hint, which is best-effort. One processor (RunPod) has no pinned region. Subprocessors |
| A stated retention period | Not provided | Material stays until you delete it, until the workspace is deleted, or until a legal retention duty applies. No retention period is set: the 28-day recovery protection and the 30-day purge eligibility are deletion mechanics, not a retention period, and copies in provider backups age out under the provider's lifecycle. Privacy notice |
| Recovery point and recovery time objectives | Not provided | No recovery point objective, no recovery time objective and no backup retention period is committed in self-service. Objectives and a drill cadence can only come from a separately executed agreement. Processing addendum (2026-09-30) |
| Contractual uptime or resolution target | Not provided | Published plans include no contractual availability or resolution commitment. The published support target is an acknowledgement target rather than a resolution time, and Enterprise support terms are agreed during scoping. Pricing |
| Third-party assurance report | Not provided | No SOC 2 report, ISO 27001 certificate or independent penetration-test report exists yet. An external penetration test is planned after the first paying customer. SOC 2 timing is not set. The processing addendum's audit right is a real right to inspect controls, not a report that already exists. Processing addendum (2026-09-30) |
| Self-hosted, private-cloud or air-gapped installation | Not provided | There is one hosted deployment. No separate installation is offered on any scope. Pricing |
Each row points at the page that makes the statement, and that page is where the wording is maintained.