Encrypted in transit
Every page, upload and API call goes over HTTPS, and browsers are told never to connect to Tella without it.
Security at Tella
How we protect your videos and your workspace, answered plainly. For audit reports and policies, visit the Trust Center.
Independently audited
SOC 2 Type II
Prescient Assurance, an independent auditor, tested our controls over a multi-month observation period. Tella is compliant on every plan, and Enterprise customers can get the report under NDA.
GDPR
Our standard data processing agreement covers the personal data you keep in Tella, including the EU Standard Contractual Clauses for transfers.
Penetration testing
An independent firm tests the Tella app for vulnerabilities. Enterprise customers can get the latest report under NDA.
How we protect your data
Encrypted at rest
Your recordings, videos and our application database are encrypted at rest with AES-256.
Stored in the United States
Tella runs on Amazon Web Services in the US East (Ohio) region. The services that help run Tella are listed in our sub-processors.
Continuous backups
Our database is backed up continuously, so it can be restored if something goes wrong.
Control who gets in
Single sign-on and SCIM
Sign in with Okta, Microsoft Entra ID, Google Workspace or any SAML or OIDC provider, and add and remove members from your directory.
Two-factor authentication
Anyone who signs in with an email and password can turn on codes from an authenticator app.
Private by default, if you want
Workspace owners choose who can watch new videos: only the creator, workspace members, or anyone with the link. Any video can also be password protected.
Approved embed domains
Choose which websites your videos can be embedded on, for one video or the whole workspace.
How we run Tella
Monitored around the clock
We monitor Tella 24/7 and post incidents and maintenance on status.tella.com.
Sign-in details kept from AI
Passwords saved for Auto Capture are encrypted with keys held in hardware security modules and never reach the AI that drives the browser. How Auto Capture protects your sign-in details.
Frequently asked questions
Yes. Tella is SOC 2 Type II compliant on every plan. Prescient Assurance, an independent auditor, tested our security controls over a multi-month observation period. We're audited again every year, and our controls are monitored continuously in between. More about our SOC 2 report.
The SOC 2 Type II report is available to Enterprise customers under NDA. Sign our NDA at links.tella.com/soc2-nda, then request the report in the Trust Center. The latest penetration test report is shared the same way.
Yes. Our standard data processing agreement covers how Tella processes personal data on your behalf, and includes the EU Standard Contractual Clauses for transfers outside the EU. If you need a signed copy, contact us.
Your videos and account data are stored on Amazon Web Services in the United States, in the US East (Ohio) region. Some of the services that help us run Tella process data in other places. Each one, with its location and purpose, is listed in our sub-processors.
Yes. Data is encrypted in transit with HTTPS (TLS) everywhere, and at rest with AES-256, including your recordings, videos and our application database.
No. Tella doesn't train AI models on your videos. When you use an AI feature, like transcription or the Tella Agent, the content that feature needs is sent to the AI provider that runs it, to deliver that feature. Every provider is listed in our sub-processors.
Yes. Tella works with any SAML or OIDC identity provider, including Okta, Microsoft Entra ID and Google Workspace, and SCIM keeps your members in step with your directory. Both are add-ons on paid plans and included on Enterprise. See Set up SSO and SCIM provisioning.
Yes. Anyone who signs in with an email and password can turn on two-factor authentication with an authenticator app. Workspaces that use single sign-on rely on their identity provider's own sign-in rules instead.
Deleted videos stay in Trash for 30 days so you can restore them, then they're permanently deleted.
Every company that processes customer data for us is listed, with its location and purpose, in our data processing agreement and the Trust Center. We give business customers advance notice before adding one, with 30 days to object.
If a breach affects your personal data, we notify you without undue delay, as our data processing agreement requires. Outages and incidents that affect the service are posted on status.tella.com, where you can subscribe to updates.
No. Tella holds SOC 2 Type II, not ISO 27001. Tella isn't HIPAA compliant and doesn't sign Business Associate Agreements, so don't record protected health information in Tella.
Yes, for Enterprise customers and teams evaluating Enterprise. Most answers are on this page and in the Trust Center. For a questionnaire or a security review, contact our team.
Email support@tella.com with what you found and the steps to reproduce it. Please don't access other people's data or disrupt the service while you test.