This page describes how Telogence protects customer data, who processes it on our behalf, and how we handle personal information. It is provided for customers and prospective customers conducting security and privacy review, including as the reference point for Exhibit B (Security Measures; Subprocessors; Privacy) of the Telogence SaaS Agreement.
Telogence helps private equity deal teams run and document investment due diligence. Customer content — uploaded sources, questions, findings, and reports — is treated as Confidential Information and protected as follows.
All connections — browser to application, application to database, and application to our AI subprocessor — are encrypted in transit via TLS, with HTTP Strict Transport Security enforced (including subdomains, preload). Customer data at rest is encrypted by our infrastructure providers.
User authentication is handled by our identity platform using email and password; passwords are hashed and never stored in plaintext. Sessions automatically time out after inactivity. Multi-factor authentication is supported by our identity platform and is on our roadmap for enforcement on customer accounts.
Telogence is multi-tenant. Customer data is isolated at the database layer using PostgreSQL Row Level Security, not by client-side logic: every record belongs to a project, and access is restricted to the project's owner and explicitly invited collaborators. Administrative functions are gated by server-side functions that independently re-verify administrator status.
The application is hosted on Vercel (global CDN and serverless functions) with data stored in Supabase (managed PostgreSQL and authentication), data-resident in AWS us-east-1. Telogence does not operate its own servers or data centers; it builds on SOC 2 / ISO-certified infrastructure providers listed in Subprocessors.
Telogence uses OpenAI to generate embeddings for semantic search and to produce AI-assisted summaries and draft answers grounded in customer-uploaded sources. All AI calls are routed through a server-side proxy so that provider API keys are never exposed to the browser. Under OpenAI's API terms, data submitted via the API is not used to train OpenAI's models.
We draw a deliberate line between the content a customer works with and the signal of how the product performed. The line is this: we learn from whether you accepted an answer, never from what you wrote.
In practical terms: we can learn that summaries above a certain length get edited down most of the time, or that a particular retrieval strategy surfaces excerpts analysts do not use — and act on both. We cannot, and do not, learn what any customer concluded about any company.
Security headers are enforced at the edge, including HSTS, X-Frame-Options, X-Content-Type-Options, a restrictive Permissions-Policy, and a Content-Security-Policy. No third-party analytics, advertising, session-replay, or error-tracking trackers are embedded in the product.
Infrastructure and request logs are available through our hosting and data platforms. Security-relevant data changes are recorded in an administrator audit trail, queryable only through access-controlled functions that re-check administrator status server-side.
Telogence notifies affected customers without undue delay, and in any event within seventy-two (72) hours, after becoming aware of unauthorized access to or disclosure of their data, together with reasonable information about the incident and our remediation efforts.
Customer data persists until deleted by the customer or, on contract termination, within the period specified in the governing agreement. Deleting a project removes its documents, questions, answers, and version history via cascading deletes at the database layer.
Application and provider secrets (AI provider keys, email credentials, database service credentials) are stored as server-side environment variables and are never exposed to the browser. The only key shipped to the browser is our data platform's public/anonymous key, which is designed to be public and is constrained entirely by Row Level Security.
Telogence is pursuing SOC 2 Type II certification. In the interim, we support customer security reviews with this Trust Center, a completed security questionnaire (CAIQ / SIG Lite) on request, and mutual NDA and Data Processing Agreement.
Subprocessor list last updated 22 August 2026.
The following third parties may process customer data on Telogence's behalf. Telogence does not sell customer data and does not use customer content to train AI models. Telogence will give customers written notice before engaging any new subprocessor that will process their data. Where a customer's agreement with Telogence specifies notice terms, that agreement governs.
| Subprocessor | Function | Data processed | Location |
|---|---|---|---|
| Supabase | Identity/authentication and primary database | All customer content and account data | AWS us-east-1 |
| Vercel | Application hosting, CDN, and serverless functions | Request data in transit; no persistent customer datastore | Global edge (primary region: Washington, D.C.) |
| OpenAI | Text embeddings and AI-assisted summaries / draft answers | Questions, excerpts of uploaded sources, and project context | United States |
| GitHub | Source code hosting and CI; storage of encrypted database backup artifacts | Encrypted database backups (AES-256, keys held solely by Telogence) — no plaintext customer content | United States / global |
| Google Workspace | Outbound transactional email (invitations) | Recipient email address; invitation/project name | United States / global |
| Stripe | Payment processing and subscription billing | Billing contact and payment method — no project content | United States / global |
Payment card and bank details are entered directly with Stripe and are held by Stripe; Telogence never receives or stores them. Content-delivery and font providers (used to serve static front-end assets and open-source libraries) may observe end-user IP addresses and request metadata as an inherent part of delivering content, but do not receive uploaded documents, questions, or answers. This list is maintained as subprocessors change and carries the date of its most recent change; customer-specific contractual terms (DPA, MSA) govern in the event of any conflict.
This section is Telogence's Privacy Policy. Effective August 2026 · Last updated 22 August 2026 · Reviewed annually.
Client project content — uploaded sources, question trees, findings, and reports — is processed by Telogence as a processor (service provider) on behalf of the customer, who is the controller. The customer decides what content is uploaded, the purposes for which it is analyzed, and the lawful basis for that processing. Where such content incidentally contains personal information about individuals mentioned in it, Telogence processes that information solely on the customer's documented instructions. Telogence does not itself offer goods or services to, or monitor the behavior of, those individuals.
Account, usage, and billing data — the information described below that Telogence collects to operate the service for its own customers — is processed by Telogence as a controller.
The platform is designed for business due-diligence material and is not intended to receive certain categories of regulated data. Customers are asked not to upload, and Telogence does not knowingly process: special categories of personal data under GDPR/UK GDPR Article 9 or criminal offence data under Article 10; protected health information subject to HIPAA; consumer report information subject to FCRA/FACTA; payment card data; or personal data of children under 16. Where a customer nonetheless includes such material, it is protected by the same technical controls described in Security Measures, but Telogence does not hold itself out as offering the additional regulatory safeguards specific to those categories.
Solely to provide, secure, and improve the Telogence service: operating the product's features (including AI-assisted analysis), authenticating users, providing support, and meeting legal obligations. We do not sell personal information, and we do not use client content to train AI models. Where we improve AI output quality, we do so using the improvement signals described in Security Measures — quantitative measurements only, from which client content cannot be reconstructed.
Data is processed by the subprocessors listed above — application hosting and serverless functions (Vercel), database and authentication (Supabase), AI processing under API terms that exclude use of submitted data for model training (OpenAI), source control and storage of encrypted database backups (GitHub), business email (Google Workspace), and payment processing (Stripe). Each is engaged under its published data processing terms, which include the data protection commitments applicable to that service. Customers are given written notice before a new subprocessor that will process their data is engaged. We disclose personal information otherwise only when required by law, with notice to affected clients where legally permitted.
Personal information is protected by the controls described in Security Measures above: encryption in transit and at rest, tenant isolation via row-level security, least-privilege access with multi-factor authentication on administrative accounts, and monitored infrastructure. Data is retained per our records retention schedule and deleted on contract termination or verified request. Deletion propagates to encrypted database backups as those backups age out on their 30-day rolling retention cycle.
On our public pages we use Google Analytics to understand which parts of the site are useful. It sets a cookie and receives your IP address, device type, and the pages you view. It runs only if you accept it — nothing is loaded and no cookie is written until you choose, and you can change your choice at any time via Cookie preferences in the footer. For this website data Telogence is the controller, and Google is our vendor; this is separate from the subprocessors that handle customer content.
We do not run analytics inside the Telogence application. The authenticated product loads no third-party analytics of any kind. We record how the product is used — which features are opened, how often, and how long operations take — in our own database, as counts, timestamps, and labels. That record never contains the text of your questions, sources, notes, findings, or answers.
Subject to applicable law (e.g., CCPA and similar state statutes; GDPR/UK GDPR where applicable), individuals may request access to, correction of, or deletion of their personal information, and may object to or restrict certain processing. Requests: privacy@telogence.ai. We respond within the timelines required by applicable law.
Where a request concerns personal information contained within client project content, Telogence acts as processor (see Our role above). Such requests are referred to the customer who controls that content, and Telogence assists that customer in responding, as required of a processor.
Security questions or vulnerability reports: security@telogence.ai
Privacy questions or data requests: privacy@telogence.ai
This page is provided for evaluation purposes and describes the platform as configured on the date above. It does not form part of any contract except to the extent a signed agreement expressly incorporates it by reference. Capabilities and controls evolve; the current version is always available at this URL.