Specifics, not badges.

Tend runs in Sydney, Australia. The application is served from Vercel's Sydney region and your data lives in Postgres, managed by Supabase, in AWS ap-southeast-2 - also Sydney. The service providers listed below also process data in their stated regions.

Everything moves over TLS - browser to app, app to database, and every call to the services listed below. At rest, your data sits in Supabase's managed Postgres, which encrypts storage as part of the platform. We also keep private off-site recovery copies in Vercel Blob, including workspace snapshots and a separate attachment mirror.

Every workspace's rows are tagged with that workspace, and isolation is enforced inside the database itself with Postgres row-level security. Each query the application runs is pinned to a single workspace for its whole transaction; the database refuses to return another tenant's rows even if application code asks. The wall is in the database layer, not just the code above it.

Tend runs a monitored nightly off-site backup with 14 days of snapshot history and a separate attachment mirror. In Settings → Backup & export, authorised admins can download workspace data as JSON. That download includes file metadata, excludes file bytes and live sessions, and removes reusable credentials. File recovery uses the separate mirror; the JSON alone is not a full recovery package.

Access inside a workspace is role-based: built-in Admin, Agent, Finance, and Read-only roles, plus custom roles with per-capability permissions. Staff sign in with a verified email link or password, with authenticator-based two-step verification. Sensitive actions - billing, settings, permanent deletion, the full export above - sit behind their own capabilities. Every consequential settings change is recorded, so you can see who changed what, and when.

The portal is private and never uses passwords. Every visitor signs in with a short-lived email link, exchanged for an httpOnly session - so there is no portal password to reuse or reset. Protecting the email account still matters. A ticket reference alone shows nothing. The sign-in form answers identically whether or not an address is known to us, so it can't be used to probe who your customers are.

Mail Tend sends on your own domain is DKIM-signed with aligned Return-Path (SPF), using records issued per workspace. We only switch your outbound mail to a custom domain once both records verify - half-authenticated mail lands in spam, so we refuse to send it.

Found a vulnerability? Email hello@tend.support with "Security" in the subject - it lands on our own service desk (which runs on Tend) and a human reads it, usually the same day. Report in good faith and we'll work with you, credit you if you want it, and never take legal action over honest research. Please don't access other people's data or degrade the service while testing.