Security at Tekmerion from the inside.

Data at rest is encrypted by the managed database Tekmerion runs on (Polsia's Postgres platform). Data in transit between the user's browser and the application is protected by TLS terminated at the platform edge. The application itself does not hold customer-managed encryption keys, and specific cipher suites / TLS versions in use are governed by the platform — not configured in application code.

All customer data is hosted via Polsia's managed database and application platform. The specific infrastructure region and any failover topology are not exposed in our application code — for region-level detail, contact us and we can share what the platform reports. A list of sub-processors is available on request.

Tekmerion does not currently hold a SOC 2 report, an ISO 27001 certification, or a published third-party penetration-test report. Pursuing structured external validation — including SOC 2 Type II — is on our roadmap, but no specific auditor, scope, or delivery date is committed today.

Every API endpoint that touches customer data is gated by session-based authentication, and every database query is scoped by the authenticated user's id — so one user's rows cannot be read or written by another. Role-based access (user / admin) is enforced at the route layer for admin-only surfaces. Multi-factor authentication and quarterly access reviews are not currently in place for our own internal accounts.

The autonomous agents run as in-platform request handlers, scoped per authenticated request — they do not have a separate sandbox or network / storage policy layer, and they execute against the same per-user data scoping described above. Every action is logged with the trigger signal, the time, and the proposed remediation, and any change that touches production data still requires a human validator before it lands.

Tekmerion commits to processing personal data only on documented instructions from the customer, with appropriate technical and organizational measures in place. A Data Processing Agreement reflecting this commitment is available on request; the underlying obligations — lawful basis, data-category mapping, sub-processor list on request, support for Data Subject Requests — are honoured in operation even though no automated DPA generator is exposed in the product today.

Confirmed incidents affecting personal data are investigated and customers are notified without undue delay. Specific notification windows, a public post-mortem policy, an on-call rehearsal cadence, and specific audit-log retention guarantees are not currently published — for incident-specific questions or to receive the response runbook, contact us directly.

Security researchers and customers can route reports directly to the security team at tekmerion@polsia.app. We aim to acknowledge quickly and to triage seriously, but specific ack / triage SLAs are not currently published — a coordinated-disclosure credit can be arranged by request.