Security
Security at TeamLens
The short version
- HTTPS everywhere, bcrypt passwords, optional two-factor sign-in, role-based access.
- Hosted on a dedicated server in Finland (EU); databases not exposed to the internet; nightly backups.
- Employees see a notice built from their organisation's real settings, and their acknowledgement is recorded with the version and time.
- Not there yet: full encryption at rest, SSO, a pen test and SOC 2. We say so here.
- CERT-In incident reporting within 6 hours. Report vulnerabilities to info@teamlens.ai.
What protects your data today
| Control | Details |
|---|---|
| Encryption in transit In place | teamlens.ai, app.teamlens.ai and api.teamlens.ai are served only over HTTPS (TLS 1.2 or newer, end-to-end to our servers). The desktop agent only talks to the TeamLens API over HTTPS and rejects any other address. |
| Passwords In place | Stored only as bcrypt hashes. We never see or store your password in readable form. |
| Two-factor sign-in In place | Users can turn on authenticator-app (TOTP) two-factor sign-in. The 2FA secrets are encrypted in our database. Google sign-in is also available. |
| Encryption at rest In progress | Two-factor secrets are encrypted at the application level. Full encryption of the production database and screenshot storage at rest is not switched on yet; it is on our roadmap and this page will say when it is. |
| Hosting and network In place | Production runs on a dedicated server in a Hetzner data centre in Helsinki, Finland (EU), behind Cloudflare. Databases are not reachable from the internet. Server administration happens over a private, key-authenticated network, not open SSH. |
| Backups In place | The production database is backed up every night. |
| Access control in the product In place | Role-based access (organisation admins, managers, employees): employees see their own data, managers their teams, admins set policy. Screenshot blurring, app exclusions and retention are set per organisation. |
| Audit trails In place | Sign-ins, admin actions and monitoring-notice acknowledgements are logged. |
| Data lifecycle In place | Screenshots and recordings are deleted automatically after 30 days by default (configurable). Customers can ask us to delete their workspace. |
| Patching and code changes In place | Servers install security updates automatically and run intrusion protection. Every code change goes through automated review and tests before it ships, and dependency vulnerability alerts are on for our repositories. |
| Payments In place | Card payments are handled by our payment provider as merchant of record. Card numbers never touch TeamLens servers. |
| Strict HTTPS (HSTS) and extra security headers In progress | Being added. |
| Single sign-on (SAML/OIDC) Not yet | Not available yet. |
| Independent penetration test Not yet | Not done yet. Planned; we'll share the summary with customers on request. |
| SOC 2 / ISO 27001 Not yet | Not certified. We'll start a SOC 2 audit when customers need it, and say so here plainly rather than borrow badges. |
How employees are told, and what they acknowledge
- Visible by design. The TeamLens agent shows itself while it runs. Silent modes are restricted to organisations that certify a lawful basis for them.
- A notice built from real settings. Before recording, each person sees a plain-language notice generated from their organisation's live settings: whether screenshots are taken, whether they're blurred, whether screenshots are sent for AI summaries, which apps are excluded, and how long data is kept. Nothing in it is boilerplate.
- A record that matches what was shown. When the person confirms they've read it, we store who, when, the notice version, a fingerprint of the exact facts shown, and which app recorded it (web, CLI, or an AI agent acting for the person, which is labelled as such). If the organisation changes what it records, everyone is asked again.
- Acknowledgement, not consent. In employment, "consent" is rarely freely given, so we don't call this consent. The employer remains responsible for its lawful basis, such as employment-related legitimate use under India's DPDP Act or legitimate interests under the GDPR.
- Self-service transparency. People can see what's held about them, and who can view it, from their own profile.
Incident response
- We investigate suspected security incidents straight away and contain them first.
- We report cyber incidents to CERT-In within 6 hours of noticing them, as required by the CERT-In Directions of 28 April 2022.
- If a breach affects customer personal data, we tell affected customers without undue delay and within 48 hours, with what we know and what we're doing, and keep them updated.
- For personal data breaches we notify the Data Protection Board of India and affected people as the DPDP Act and its Rules require, and help customers meet their own GDPR duties (including the 72-hour regulator notice).
Report a vulnerability
Email info@teamlens.ai with the subject "Security", with steps to reproduce. We'll acknowledge within 3 business days and keep you updated until it's fixed. Please test only against your own account, don't access or change other people's data, avoid degrading the service, and give us reasonable time to fix before disclosing. We won't pursue good-faith research that follows these rules.
Questions and security reviews
Send your security questionnaire to info@teamlens.ai. We answer line by line, including the lines where the answer is "not yet". See also our Privacy Policy and DPA and sub-processor list.