Trust Center

Customer application and API requests, including streaming responses, pass through Cloudflare to Teammately’s Azure application infrastructure. Auth0 provides identity authentication. The authenticated API boundary performs workspace and project authorization before routing work to internal services.

Application services and PostgreSQL run on Azure Kubernetes Service. Customer objects and database backups are stored in Azure Blob Storage. Core hosting is in Central US. AI processing and traffic delivery have separate geographic scopes.

Durable evaluation workflows are handled by backend workers. Depending on the workflow, customer content is included in prompts or files sent to model services. Customer-configured integrations should be reviewed as part of the deployment’s processing scope.

Scope: core service architecture. Source and configuration review, September 2026.

Teammately does not use customer workspace data to train shared generative models without express written agreement. Processing customer content to perform a requested evaluation is separate from training a shared model.

The reviewed primary evaluation client requires an Azure OpenAI or Microsoft Foundry endpoint. Azure Global deployments may process prompts and responses across supported geographies. Some evaluation workflows request stored responses; retention must be assessed for the specific feature and workflow.

Microsoft’s AI data processing documentation describes service storage, model training terms, and abuse monitoring. Contact us to review the requirements for your selected workflows.

Scope: reviewed primary evaluation client and Azure model processing. Reviewed September 14, 2026.

Application permissions are scoped to workspaces and projects. Artifact access checks include the authenticated workspace, project access, and deletion status. Possession of an artifact URL does not itself grant access.

Workspace credentials use envelope encryption and are managed separately from evaluation scripts. Management responses return metadata and masked hints. Runtime resolution checks execution context, expiration, and active grants. Azure Key Vault provides infrastructure secret access and recovery controls.

Internal policy requires an authorized business purpose for personnel access to customer content and records of access decisions. Product authorization and human infrastructure administration are distinct controls.

Implementation reviewed September 11; Key Vault configuration checked September 13; policy adopted September 14, 2026.

A PostgreSQL backup was restored into a separate test cluster. The recorded validation covered schema inventory, representative row counts, and read/write testing.

Customer and backup Blob accounts have versioning and 30-day soft deletion enabled. These protections help recovery; they do not define a guaranteed recovery objective or maximum data-erasure period.

Our internal policy establishes backup review and restore-test responsibilities. Discuss recovery objectives and deletion requirements with us for your deployment.

Historical exercise: July 4, 2026. Storage configuration checked September 13, 2026.

Our adopted procedure covers identity and authority verification, request ownership, response deadlines, customer-controller coordination and completion evidence. Contact [email protected] for access, correction, deletion or other privacy questions.

Retention and erasure reviews account for application records, files, model-service data, operational records and backups. Backup recovery periods are separate from permanent erasure timelines. Processing locations and optional integrations are reviewed for the intended customer workflow.

Procedure adopted September 14, 2026. Request supporting documentation through our privacy contact.

Email [email protected] to request access, correction or deletion, or ask a privacy question. These messages reach our accountable owner. We verify identity and authority as appropriate. For customer-controlled workspace data, we coordinate with the customer organization and act on its documented instructions.

Teammately Inc. is the contracting company. We process customer workspace content on the customer’s instructions. Our Privacy Policy describes our own processing for website, account and business administration. The applicable agreement and purpose determine the processing role.

The GDPR and CCPA / CPRA marks identify the privacy frameworks addressed by this page. The SOC 2 mark identifies our Security readiness program targeting a Type 2 examination, with readiness in progress. Individual controls describe their evidence, status and review date.

Teammately does not use customer workspace data to train shared generative models without the customer’s express written agreement. Models used in workflows process data to provide the requested service. Provider processing and retention terms apply separately.

Core application infrastructure, databases, customer Blob storage, and PostgreSQL backup storage are hosted in Azure Central US. Auth0 uses a US tenant. Cloudflare traffic delivery and Azure Global model deployments have separate processing geographies.

View service providers

Some evaluation workflows use stateful model responses and request response storage. Retention and deletion depend on the API feature and workflow. Contact us to review the processing requirements for your intended use.

Application access follows server-side workspace and project permissions, including checks for evaluation artifacts. Internal policy requires a documented business purpose and authorization for personnel access to customer content.

View access controls

Retention follows the applicable agreement and operational requirements for each data store. Deletion scope includes application data, artifacts, provider data, logs, and backup expiration. Storage recovery windows are distinct from permanent erasure timelines. Contact us to agree on requirements for your deployment.

A PostgreSQL restore exercise was documented, including schema checks, representative row counts, and read/write validation. Recovery objectives for a deployment should be discussed separately from this historical exercise.

Read recovery summary

Send the document names or your security questionnaire to [email protected]. We can discuss the relevant scope and supporting evidence. Internal policies and detailed operational evidence are shared through a reviewed request.

Email [email protected] with the affected feature, potential impact, and reproduction steps. Omit credentials and sensitive customer data from the initial message.