Security at Temble

Temble is designed with defense in depth. Controls are layered across our application, infrastructure and operations so that a failure in any one layer does not compromise the platform as a whole. This page summarizes the practices in place today and is updated as the program evolves.

• In transit. All connections to Temble use TLS with modern cipher suites. HTTP requests are redirected to HTTPS.
• At rest. Data stored in our primary databases and object storage is encrypted at rest using industry-standard algorithms managed by our cloud providers.
• Sensitive fields. Additional application-level controls apply to sensitive fields such as secrets and API keys.

• Password authentication with modern hashing.
• Optional single sign-on with supported identity providers.
• Multi-factor authentication for administrative operations.
• Session management with automatic expiration and revocation.

Temble runs on reputable cloud infrastructure with network isolation, hardened machine images, and configuration managed as code. Changes go through peer review and automated checks before deployment.

We centralize application, infrastructure and security logs. Alerts route to on-call engineers for triage. Baselines and anomaly detection help us identify unusual behavior early.

• Access to production systems follows the principle of least privilege.
• Administrative access requires strong authentication and is logged.
• Access rights are reviewed periodically and revoked when no longer needed.

We maintain an incident response process covering detection, containment, eradication, recovery and post-incident review. Where an incident affects customer data and notification is required, we notify affected customers in line with applicable law and our contractual obligations.

We welcome reports from the security community. If you believe you have found a vulnerability in the Services, please email {{Support Email}} with the subject line “Security disclosure”. Please provide enough detail to reproduce the issue and avoid actions that could harm the platform or its users (for example, denial of service, data exfiltration or accessing accounts that are not your own).

• Use unique, strong passwords and enable multi-factor authentication.
• Rotate API keys periodically and never commit them to client-side code.
• Grant team members the minimum role required for their tasks.
• Verify webhook signatures on every incoming request.

For general security questions, visit our Contact page. Sensitive reports should be sent to {{Support Email}} with “Security” in the subject line.