Overview

Security, privacy, and compliance posture for Tero-hosted and self-hosted deployments.

Last reviewed: March 5, 2026 Owner: Security + Engineering Review cadence: Quarterly Status: In progress

You need fast, concrete answers: what Tero operates, what data it handles, where responsibility splits, and what evidence you can get.

Reviewer focus

• What is live today versus still in progress
• What changes between Tero-hosted and self-hosted deployments
• Where to go next for architecture, ownership, and evidence details

Implementation status (March 5, 2026)

Topic	Status
SOC 2 Type II	In progress (target: July 2026)
Encryption	Enabled in transit and at rest
Deployment models	Tero-hosted and self-hosted
AI provider options	Hosted default provider plus bring-your-own provider options

If a control is in progress, we mark it as in progress.

Start your review

Security Architecture

End-to-end request flow, trust boundaries, and control points.

Shared Responsibility

Ownership split by deployment model.

Reviewer Map

Questionnaire topic to page lookup.

Deployment boundary at a glance

Area	Tero-hosted	Self-hosted
Control plane runtime	Operated by Tero	Operated by customer
Network perimeter	Managed by Tero baseline controls	Managed by customer
Data locality control	Tero-hosted region model	Customer-chosen region/infrastructure
AI provider path	Hosted default and configured options	Customer-controlled provider path
Infrastructure patching and operations	Tero	Customer

Default hosted data scope

Data class	Stored	Why
Account and workspace configuration	Yes	Service configuration and access control
Telemetry metadata (schemas, field types, volume patterns)	Yes	Catalog, analysis, and policy generation
Full raw telemetry content	No (default model)	Source of record remains your observability platform
Authentication metadata	Yes	Session and access control
Billing records (self-service)	Limited scope only	Billing operations

In practice

• Baseline integration does not require vendor-initiated inbound connectivity into your environment.
• Full raw telemetry is not the default hosted system-of-record data model.
• In self-hosted mode, you own the infrastructure and network control layers.

Evidence path

Topic	Public evidence	Additional evidence (on request)
Architecture and trust boundaries	Security Architecture	Architecture walkthrough and control notes
Responsibility split	Shared Responsibility	Deployment-specific control allocation review
Encryption controls	Encryption Standard	Platform control evidence and security review package
Subprocessors and data handling	Subprocessors and Third Parties	Subprocessor and data-flow detail under NDA
AI data handling options	AI Data Controls	Deployment-specific model and provider configuration review

In progress

• SOC 2 Type II is in progress.
• Target issuance window: July 2026.

Request security artifacts

Email with your checklist, deployment model, and review timeline.