←Back to Tootela

Security

Tootela is the operating system for your business. Trust is the only thing that matters. Here's how we earn it : honestly, without overclaiming.

Last updated 2026-07-16
Bottom line. Data is encrypted in transit and at rest by our infrastructure providers. Your database lives in the EU (eu-west-3 (Paris, France)). No customer content is used to train AI. Found a vulnerability? Email contact@tootela.net.

Tootela is operated by Tootela SAS, a French company. This page is provided in English for convenience; in case of dispute, French law applies as set out in our Terms of Service.

Overview

This page describes the security controls Tootela actually has in place today : nothing more, nothing less. We are a small company and we deliberately build on hardened, audited infrastructure (Vercel, Supabase, Stripe) rather than operating our own. As we ship new controls, we update this page.

Encryption

In transit

All connections to Tootela are protected with TLS. Traffic between our application and our database, storage and third-party providers is also encrypted in transit.

At rest

Customer data is encrypted at rest by our infrastructure providers : database, backups and object storage are encrypted on disk by Supabase (on AWS infrastructure), with keys managed by the provider.

Passwords

Authentication is managed by Supabase Auth (GoTrue). Passwords are hashed by Supabase and are never stored or logged in clear text by Tootela.

Authentication

  • Two-factor authentication: available for all users via a one-time code sent by email. Verified devices are remembered for 30 days.
  • Session management: Supabase-managed access and refresh tokens, invalidated on sign-out.
  • Email verification on registration.
  • Google sign-in (OAuth) available as an alternative to passwords.

We do not currently offer SAML SSO or hardware-key/passkey (WebAuthn) authentication. If your organisation needs these, tell us : it helps us prioritise.

Access controls

  • Inside the app: role-based access control within each workspace, and row-level security at the database level so a workspace can never see another workspace's data.
  • Inside Tootela: production access is restricted to a very small number of authorised people.

Infrastructure

Tootela runs on a small, intentional stack:

  • Application: Next.js, deployed on Vercel. Serverless, auto-scaled, DDoS-protected at the edge.
  • Database, auth, storage: Supabase. Postgres with row-level security as the primary trust boundary. Region: eu-west-3 (Paris, France).
  • Email: Resend.
  • Payments: Stripe. Card data never touches our servers.
  • AI features: Google Gemini API. Content is sent only when you use an AI feature, only to generate the response, and our agreement with Google prohibits training on it.

Every provider that can access customer data has a written data processing agreement covering GDPR. See the subprocessor list in our DPA.

Data handling

  • Residency: the database is hosted in the EU (eu-west-3 (Paris, France)).
  • Backups: our database provider takes automatic daily encrypted backups.
  • Tenant separation: data from one workspace cannot be queried from another. Enforced at the database row level, not just at the application layer.
  • No training on customer data. Content you put into Tootela is never used to train AI models, ours or anyone else's.

Development practices

  • TypeScript everywhere: type checks run before every deployment.
  • Secret management: secrets live in Vercel and Supabase environment variables, never in the codebase.
  • Separated environments: changes are deployed and verified on a development environment before reaching production.
  • Dependency updates: dependencies are kept up to date and reviewed when security advisories are published.

Incident response

If a security incident affects your data, we'll inform you without undue delay : within 48 hours of becoming aware, as committed in our DPA : with what happened, what data was involved and what steps we're taking. Where GDPR requires it, we notify the CNIL within 72 hours. Service incidents are published on our status page.

Compliance

  • GDPR: Tootela is a French company; GDPR governs how we process personal data. See our Privacy Policy and DPA.
  • EU data residency: the database is EU-hosted by default. For non-EU subprocessors we rely on EU Standard Contractual Clauses (SCCs) plus supplementary measures.
  • Certifications: we do not currently hold SOC 2 or ISO 27001 certifications, and we won't imply otherwise. Both are on our longer-term roadmap. Our core providers publish their own certifications (Supabase: SOC 2 Type II; Stripe: PCI DSS Level 1).

If your procurement team needs a security questionnaire, send it to contact@tootela.net.

Responsible disclosure

If you believe you've found a security vulnerability in Tootela, please report it to contact@tootela.net. Include enough detail to reproduce and, if possible, a proof of concept. We commit to:

  • Acknowledge your report promptly, normally within two business days
  • Keep you updated on remediation progress
  • Credit you (or keep you anonymous, your choice) once the issue is fixed

Please do not exploit the vulnerability beyond what's needed to demonstrate it, do not access data that isn't yours, and don't run automated scans on production. Acting in good faith protects you under our safe-harbour policy.

Out of scope: denial-of-service attacks, social engineering of our staff, physical attacks, vulnerabilities in third-party services we depend on (report those to the vendor).

Questions?

Reach our security team at contact@tootela.net.