Skip to main content

Security and Privacy

At Teckel AI, the security and privacy of your data are our top priorities. We have implemented a multi-layered security strategy to ensure that your information is always protected.

Data Isolation​

Each organization's data is isolated in our multi-tenant architecture. We use a combination of Postgres Row Level Security (RLS) and application-level security controls to enforce strict data separation. This multi-layered approach means that even in the unlikely event of a bug in one area, our system should prevent cross-organizational data access. All data is tagged with your unique Organization ID, and all API calls and dashboard views are scoped to your organization.

API Security​

Access to the Teckel AI API is secured through multiple layers:

  • API Key Authentication: Keys are generated with cryptographically secure random values and prefixed for easy identification (e.g., tk_live_ for production)
  • Secure Storage: We store only SHA-256 hashes of API keys (never the keys themselves)
  • Request Validation: All incoming data is validated for structure, size, and sanitized
  • Rate Limiting: Per-organization limits prevent abuse while ensuring fair resource allocation

User Privacy​

We treat all of your data, including queries and document snippets, as confidential customer data. We do not use your data for any purpose other than providing our services to you. We do not resell, aggregate, or mine your data to train our own models. You retain full ownership of your data at all times.

Compliance and Data Retention​

We never receive your full documents, and only store shared chunk text for a maximum of 49 hours before purging. We retain a minimal "chunk summary" sentence for use in providing document feedback to you. Open AI logs (which contain chunk text) are kept on their servers for 30 days, we are in the process of applying for Zero Data Retention (ZDR). Other than chunk text we keep all trace data including question, response, and other shared metadata, for as long as allowed by your Teckel AI Plan. For enterprise clients we can implement organization-specific retention policies.

If you choose to leave our service, we can export your data to you for your convenience and securely purge it from our systems. We will never sell your data or use it for training purposes.

Fail-Safe Design​

The Teckel Tracer SDK prioritizes your application's stability:

  • Non-Blocking Operations: SDK calls never block your application flow
  • Graceful Degradation: Service unavailability results in silent failure (your AI chatbot continues working)
  • Automatic Recovery: Traces are queued locally and submitted when service resumes
  • Timeout Protection: Configurable timeouts prevent hanging requests
  • Error Isolation: SDK errors are caught and logged without affecting your application

This design ensures that Teckel AI enhances your system without becoming a critical dependency.

Third-Party Components​

We rely on trusted, enterprise-grade third-party services for our infrastructure, including OpenAI for our audit model Supabase (hosted on AWS) for our database, and fly.io for microservices including batch processing. We currently store data in AWS us-east-2, though this is subject to change. We configure these services with high security settings.