How Tengu keeps your data safe

The app runs on Vercel. The database, sign-in and file storage run on Supabase (Postgres). Card payments go through Stripe, so card numbers never reach Tengu. AI requests go through Vercel’s AI Gateway to Anthropic and Google (or Amazon Bedrock and Google Vertex AI, which run the same models); NPCs (Studio) run on Anthropic’s Managed Agents, on Tengu’s own account. A video file Tengu Bot is asked to watch is made smaller on Tengu’s server, kept in Tengu’s file storage only until it has been watched, and sent to Google through the AI Gateway in the request that watches it. Email goes through Resend. Meeting recording goes through Recall.ai. Product analytics and recordings of visits to Tengu’s pages go to PostHog. The privacy page says what each one receives.

• Everything between your browser, Tengu and the tools it connects to travels over HTTPS (TLS).
• The database and file storage are encrypted at rest (AES-256).
• The tokens Tengu holds for ClickUp, Slack (Tengu Bot’s, and members’ own for replies), Tengu Bot’s connections, your Claude Code routine and members’ Google accounts, and the secrets that sign webhooks, are kept in Supabase Vault: encrypted, and readable only by Tengu’s server. Google’s short-lived access tokens are never stored.
• A Linear API key or Jira API token you paste for an import is kept in Supabase Vault only while that import runs. Tengu deletes it when the import finishes, fails or is cancelled, and never shows it back in the browser.

Your browser talks only to Tengu’s server. For every request, the server checks who you are, which company you are in and which lists you can see, and only then reads or writes the data.

The database refuses browsers outright: signed-in and anonymous users hold no privileges on any table, so even a bug in the page could not query it. A test checks every table for this on every change. The browser uses Supabase only to sign you in and to receive your own private live updates.

• ClickUp (importer): Tengu connects as the person who authorizes it and reads the lists they choose to import: tasks, subtasks, statuses, comments and attachments. ClickUp’s connection has no read-only option, but the importer only reads, and connecting registers nothing in your ClickUp workspace: no webhook, and no change to any task. Disconnecting ClickUp in Settings ends the connection.
• Linear (importer): with a personal API key you paste, Tengu reads the team you choose to import, or one project in it: issues, sub-issues, statuses, labels, comments, attachments and files, and the names and emails of the people on them, to match them to your members. It only reads.
• Jira (importer): with your Jira Cloud address, your Atlassian email and an API token you paste, Tengu reads the project you choose to import: issues, sub-tasks, statuses, comments and attachments, and the names and emails of the people on them, where Jira shows them. The token is sent only to your own atlassian.net address. It only reads.
• GitHub: Tengu’s GitHub App works only on the accounts and repositories you install it on. It reads and writes pull requests and code so it can merge and open release PRs, reads deployments to know when a quest is live, reads checks and commit statuses to show whether a pull request passes them, and reads organization members to confirm who owns an organization.
• Slack (Tengu Bot): in the channels an admin connects, it reads the threads it is mentioned in or takes part in, every message where an admin set Every message, and the direct messages people send it. It posts replies, shows previews of Tengu links, adds reactions, reads the files in a thread it is asked about, and reads member names and whether each is a Slack guest, so it can say who is who and keep team-only details out of a channel a client can read. It never asks for email addresses. Its message shortcuts (Create ticket, Add to Today, Save as note) get only the message someone picks them on. It has no permission to search Slack, and what waits on a member for Today comes from the threads it already keeps, never a channel’s history or anyone’s direct messages. It joins a public channel only when an admin who is in that channel connects it, and never one it was removed from. Its token is sent only to Slack, and every request from Slack is checked against Slack’s signature. What it keeps, and for how long, is on the privacy page.
• Slack replies as you (Today): a member who wants to answer a Slack thread from Today gives Tengu one permission on their own Slack account, chat:write, and nothing that reads their messages. Tengu posts with it only the reply the member wrote, in a thread that waits on them, when they press Send, as plain text that can’t ping anyone. The token is kept in Supabase Vault and sent only to Slack. Disconnect in Settings, or unlinking Slack, asks Slack to take it back and deletes it, and Slack revoking it, or Tengu Bot leaving that Slack workspace, deletes it too.
• Meetings (Studio): Tengu Bot joins only calls someone sends it to: with /tengu join or by pasting a call link in a channel where an admin turned Meetings on, from a meeting in Tengu, or every call of a series on your connected Google Calendar that someone switched on. It joins as a participant named Tengu Bot (recording). Our meeting-recording provider, Recall.ai, records the call so the bot can write the recap, and deletes its copy once the recap is written. A call a linked member sends from a Slack channel gets its own meeting room, which the channel’s recap links to, and is kept as a meeting’s call; any other call recapped in Slack keeps only its recap. A call recorded for a meeting keeps its recording and transcript in Tengu’s private storage for 90 days, opened only by the meeting’s people through short-lived links, then deletes both and keeps the summary. Removing the bot from a call keeps nothing. On Studio, Tengu gives Recall.ai a copy of the Google token of each connected calendar (below), to read the calendar with alone: Tengu keeps its events with a call link for the next 28 days (their titles, times, links and invitees’ email addresses), Recall.ai keeps them in sync, and disconnecting deletes them, at Recall.ai too, as does a move to a plan without Meetings.
• Connections (Studio): MCP servers you add for Tengu Bot, such as a Supabase project, Intercom or Linear, signed in with a token you give it or with OAuth. Only tools the server marks read-only run on their own, and only the ones you leave on; a tool that changes something runs only after the person who asked presses Run in Slack. Supabase projects connect in Supabase’s read-only mode.
• Google Drive (Studio, Tengu Bot’s docs): each member who adds docs connects their own Google account. Tengu asks Google for the account’s email and for the drive.file permission, which opens to Tengu just the files that member picks in Google’s picker, one by one, never the rest of their Drive. It reads those files through Google’s Drive, Docs, Sheets and Slides APIs. drive.file would also let Tengu change the files it opens: Tengu never does. Disconnect Google in Settings deletes Tengu’s token and the text it copied, and asks Google to take its access back unless the same Google account is connected in another workspace.
• Google Calendar (Today, and Meetings on Studio): each member who wants their day on Today connects their calendar, on the same Google account as their Drive if they connected one. Tengu asks Google for two permissions: calendar.events.readonly, which is read-only, for the member’s events on their main calendar one day at a time, and calendar.app.created, which reaches only calendars Tengu makes. Tengu makes one for each workspace, named for it (“Tengu · Acme”), the first time it writes a block, and writes the member’s planned blocks there as events of its own, each with an id Tengu makes from the block, found again by the marks it put on them. Neither permission lets Tengu change or delete anything on the member’s own calendars. It checks that id before it changes or deletes an event, and that a calendar isn’t the member’s main one before it writes to it; the permission keeps Tengu to the calendars it made. Tengu keeps the token encrypted in Supabase Vault; on Studio it gives Recall.ai a copy for meetings, which Recall.ai deletes when the workspace moves to a plan without Meetings. Nothing Tengu reads for Today goes to an AI model or to PostHog. Disconnecting the calendar in Settings deletes the Tengu calendar, with everything on it, then Recall.ai’s copy, and stops Tengu reading the member’s, keeping Drive; with no Drive connected, it ends the Google connection and gives Google its token back, as Disconnect Google does, which ends both.
• Claude: nothing to authorize. You create a routine in your own Claude account and paste its trigger token into Tengu. Tengu never holds your Claude login.

Inside a workspace, members see the lists they are on and only their own hours, rate or salary, and pay. Rates, salaries, costs and margins are for the workspace’s owners and admins, and their budget alerts in Slack carry percentages, never dollars. A member’s days off are seen by that member, Operations, admins and owners, and the PMs of projects the member is on. Prizmstack staff are in a customer’s workspace only if the customer set it up with us or invited us, and Admin › Members marks each of them as Tengu staff. Staff who set one up stay admins after handing it on, until they leave or the customer removes them. Our staff console shows each company’s billing (its plan and seats, the owner’s name and email, the admins’ names) and the names of people who have left it, so we can carry out a written request to remove one. The full list of promises is on What Tengu will never do.

If you disconnect a tool in Tengu, or de-authorize Tengu in GitHub, we delete that connection’s tokens within 10 days. A Linear or Jira key is deleted as soon as its import stops. Quests you imported stay in your workspace. The text Tengu copied from a Google Drive file goes as soon as the file is taken off its shelf or the Google connection that read it goes. Tengu keeps nothing it reads from a calendar for Today; on Studio, the calls with a link Recall.ai syncs for meetings go a day after they end, and all of them with the member’s calendar or Google connection. A member’s Slack token for replies goes as soon as they disconnect it or unlink Slack, or Slack says it was revoked.

When Tengu Bot is removed from a Slack workspace, in Slack or with Disconnect in Admin › Tengu Bot, its token is deleted at once, with the tokens members there gave for replies, and Tengu checks each day that its access still works. Seven days later everything else it kept of that workspace goes: channels and their docs shelves, message copies, linked accounts, its activity log, and call recaps with their minutes and suggested tickets. Tickets and automations your team made from Slack stay, and so do the to-dos and notes members made from Slack messages, and meetings in Tengu, only without the channel.

If a security incident affects your data, we tell your workspace’s owner without delay, and at the latest within 72 hours of confirming it: what happened, what it touched and what we are doing about it. If it touches data from Slack, we tell Slack without delay too.

Found a vulnerability, or have a question your security review needs answered? Write to security@tengu.work. We read every report and aim to answer each one.