Security and data

What Tendveo does with your data, concretely, and what it does not do yet. Missing points are written here rather than discovered after payment.

1. Hosting

The service runs on a server hosted by OVH SAS, 2 rue Kellermann, 59100 Roubaix, France (serveurs dans l'Union européenne). Data stays within the European Union. The site is served over HTTPS; the certificate renews automatically.

2. Account and sign-in

• No password to remember: you sign in with a link sent to your address, valid once and for a limited time.
• The session is a server-signed cookie; an address typed into a form never switches the session to another account.
• Sensitive requests (sign-in, forms) are rate-limited per network address.

3. Payment

Payment is handled by Stripe Payments Europe Ltd. No card number passes through or is stored with us; we receive from Stripe a customer identifier and the signed subscription state. A payment we could not attach to an account is never silently lost: it is kept and raises an alert.

4. What we store, and for how long

Your address, your trade profile, your favourites and your « relevant / not for me » feedback, technical logs. Retention periods and legal bases are in the privacy policy. At the end of a contract you have thirty days to export your data; after that your profiles, favourites and feedback are deleted automatically (daily purge), and the account itself on request, except where the law requires retention.

5. Processors

• OVH SAS, hosting (European Union).
• Stripe Payments Europe Ltd, payment.
• Sentry, technical error log (no profile content).
• OVH, e-mail delivery (daily digest, sign-in link).

6. Backups and deployments

Before each production release the previous code is kept and the database is never overwritten; a failed release is rolled back automatically. A daily off-server database backup is being set up: until it is proven, we do not advertise it.

7. What we do not have

• No certification (ISO 27001, SOC 2, HDS). We will say so here the day we have one.
• No database encryption at rest beyond that of the hosted disk.
• No two-factor authentication: the one-time sign-in link stands in for it.

8. Report a vulnerability

Write to contact@ineya.studio with reproducible details. We acknowledge within two working days and keep you informed of the fix. No action against good-faith research that does not touch other people's data.

A data processing agreement (DPA) is provided on request at the same address, for clients who need one.