Security at Tessforth

Your roadmap and your bugs are some of the most sensitive things your company writes down. Here is how we protect them.

Compliance: SOC 2 Type II

Tessforth is SOC 2 Type II compliant. Our controls are audited every year by an independent CPA firm against the Security, Availability and Confidentiality trust services criteria; the current report covers 1 August 2025 to 31 July 2026. Customers and prospects can request the report under NDA by writing to security@tessforth.com.

We are GDPR compliant and sign a data processing addendum with every customer (DPA). We are not ISO 27001 certified.

Single sign-on

• Google sign-in on every plan.
• SAML 2.0 single sign-on (Okta, Microsoft Entra ID, Google Workspace, OneLogin, JumpCloud and any SAML 2.0 identity provider) on Business and Enterprise.
• SCIM 2.0 user provisioning on Enterprise.
• Enforce SSO for every member, and restrict sign-up to your verified domains.

Audit log

On Business and Enterprise, admins see an audit log of security-relevant events: sign-ins, SSO changes, API key and OAuth app creation, member changes, exports and permission changes. Business keeps 1 year of events; Enterprise sets its own retention and can stream events to a SIEM.

Data location

Workspaces are hosted in the United States (AWS us-east-1, Virginia) by default. On Business and Enterprise, you can choose the EU region (AWS eu-central-1, Frankfurt, Germany) when you create the workspace: issues, comments, attachments, search indexes and backups then stay in the EU. Existing workspaces can be moved to the EU region on request.

Encryption

Data is encrypted in transit with TLS 1.2 or later and at rest with AES-256. Backups are encrypted, kept for 30 days and stored in the same region as the workspace.

API and integrations

Personal API keys (tf_api_…) act as the user who created them and can be revoked at any time in Settings > API. OAuth apps, including the MCP server at mcp.tessforth.com, ask for consent and get scoped, expiring tokens. Webhooks are signed with a per-webhook secret.

Infrastructure and practices

• Annual third-party penetration test; summary available under NDA.
• Production access through SSO with hardware keys, logged and reviewed quarterly.
• 99.9% uptime SLA on Business, 99.95% on Enterprise.
• Responsible disclosure: security@tessforth.com.

See also: Subprocessors · Privacy policy · Plans