Tellstack Security
In short: no passwords, short sessions, every query bound to the workspace, every public input checked.
What is in place
- Sign-in
- Passkeys (WebAuthn). No password, no password store, several passkeys per account.
- Sessions
- Access token 15 minutes, HttpOnly and Secure. The refresh session rotates on every use.
- Revocation
- End individual sessions or sign out all devices at once.
- Workspace boundary
- Every query filters on the workspace id as well. IDs from the client never count as permission.
- Key permissions
- Public project keys only write. The hash is what is stored and looked up.
- Input
- Everything public goes through schemas: type, length, allowed values. 64 KB per request.
- Abuse
- Rate limits per key, IP and form, plus a bot trap in the form.
- Webhooks
- Targets over https only, no internal address ranges, signed with HMAC-SHA256.
- Output
- Text is escaped when rendered; there is no raw HTML from user input anywhere.
- Errors
- Internal messages stay in the server log. What goes out is a neutral answer without key fragments.
- Location
- Application, database and backups run on a server in Germany (Nuremberg data centre).
Limits worth knowing about
- The only way back into an account is a recovery code. There is no second route, not even through us. So create several passkeys and keep the codes somewhere separate.
- The export covers your feedback, not the whole account. Feedback can be downloaded as CSV or JSON at any time. A subject access request under Art. 15 GDPR is answered by hand.
- Destructive steps need no second approval. An owner can delete a project or an empty workspace alone. Hand out the owner role sparingly — feedback itself is always kept, though.
This list is here because a security page without open points is not credible. It names no plans — only what holds today.
Frequently asked questions
Does Tellstack store passwords?
No. Sign-in runs entirely on passkeys (WebAuthn). There is no password database, so there is nothing to steal in a breach.
How long does a session last?
The access token is valid for 15 minutes and lives in an HttpOnly cookie, not in localStorage. Behind it is a refresh session that rotates on every use and can be revoked server-side.
What happens if a refresh token is stolen?
It is worthless after its first use, because every renewal issues a new one. On top of that, each session can be ended individually, and "sign out everywhere" revokes them all at once.
Can a project key read data?
No. Public project keys can only write feedback. There is no endpoint that hands anything out for such a key.
Where is my data stored?
On a server in Germany (Nuremberg data centre), together with the backups. Payment, email delivery and — only on plans with the AI layer — the analysis run through individual processors; the privacy notice names them and their purpose.
Does Tellstack use tracking or advertising cookies?
No. There is no analytics script, no advertising cookies and no session recording. The only cookies set are the ones technically needed for signing in.
Found a hole?
Reports of security holes are welcome and will not be answered with lawyers. Please use the address given in the privacy notice and give us time to fix it before it goes public.