Security without certification theatre

Workspace isolation

Every piece of work data belongs to one workspace, and every query is scoped to it.

• People see only workspaces they belong to
• Private resources outside your access answer as “not found”, so their existence isn’t revealed

Roles and permissions

Owner, Admin, Member, Viewer and Guest roles, private projects and custom roles. Hiding a button is never the protection: the server checks every change.

• Private projects grant nothing through the workspace role alone
• Guests see only projects or items shared with them
• Custom roles narrow rights for specific jobs

Telegram permissions

Tydy processes only the chats you connect, not your whole Telegram account.

• Each chat is connected with a one-time code
• AI processing can be turned off per chat and topic
• Writing to Telegram from Tydy is a separate permission

Telegram Business: personal chats

Personal chats appear in a workspace only when you add them. A dialog you haven’t added stays outside the workspace entirely.

• Messages of dialogs you haven’t added sit in a private buffer visible only to you, kept for at most 30 days or the last 500 messages
• After you add a chat, the workspace copy becomes the record; the private buffer is trimmed to 14 days or 100 messages
• You decide who may reply from your account; support access can never send as you

Sign-in and sessions

Password or email sign-in with sessions in HttpOnly cookies.

• CSRF protection on every state-changing request
• Sessions expire after inactivity and have an absolute limit
• “Remember this device” is optional; signing out everywhere or changing the password revokes it

Email sign-in with device approval

An email link never signs anyone in by itself. It opens a page where you confirm the sign-in explicitly; the tab where you started then signs in.

• Opening or prefetching the link does nothing, so mail scanners can’t use it
• The attempt is tied to the starting browser by an HttpOnly cookie
• Links are single-use and expire

Audit and security events

Significant workspace actions are recorded, including writes made by agents through MCP. Sign-ins and blocks are tracked as security events.

• Applied AI actions keep their source and can be undone
• Operators investigate suspicious activity in the Security Center

Backups and restore checks

The database is backed up twice a day and files daily. Backups are encrypted and copied to storage outside the production server.

• Retention: every backup for 7 days, then daily, weekly and monthly copies up to 6 months
• An automatic restore into an isolated database runs every week
• Missing or stale backups raise an alert

Application protection

The Security Center filters requests before they reach application logic.

• Rate limits on sign-in and other sensitive routes
• Automatic temporary blocks for abusive traffic
• Exact thresholds are not published

Support and admin access

Platform support can open a workspace only through a support session, never as a hidden member.

• Sessions are time-limited and record who, when and why
• Read-only unless write access is explicitly granted
• Support can’t send Telegram Business messages as the owner

AI agents via MCP

Agents act within token scopes ∩ your role ∩ plan, in one workspace. Tokens are stored as hashes and revoked instantly; attachments are served through short-lived links.

Connect via MCP

What we don’t claim

We describe what the product ships, not badges.

• Tydy has no SOC 2 or ISO 27001 certification
• User content is not end-to-end encrypted

Responsible disclosure

Found a vulnerability? Send a short summary, the affected component, reproduction steps and impact. Please don’t include passwords, session cookies or live MCP tokens.

security@tydy.devLegal