Security and privacy

Each company is isolated

• Each request belongs to a single company.
• The person making the request must be a member of that company.
• If a request’s company is not certain, access is refused. No other company is picked in its place.
• A company’s plans, inventory, logo and profile are never visible to another company.

Who has access

• The company’s members, according to their role and the access chosen by the administrators. See Members and access.
• A member without access to a service does not see that service’s tools. If they try to use them anyway, the request is refused.
• Our tools also check this access on their side.
• No one can create a company on their own. TektonAI opens each workspace, by invitation.

Your assistant’s connections

• Each time you connect an assistant, a page asks for your consent. It says what the assistant will be able to do: use our tools and read the company profile. It has no access to the console.
• A connection works only with our service. It cannot be used anywhere else.
• A connection expires after one hour and renews on its own.
• Each time the assistant uses our tools, we know which member is really acting. This information carries a signature that only our services can verify. It does not leave our services.
• You can revoke a connected assistant at any time, on the Connected assistants page. Its next request is refused.
• Removing a member in Members revokes all their assistants. See Cut someone’s access.

Sensitive actions

An import that changes your inventory in bulk waits for your confirmation:

• if your app shows the “Importer / Annuler” (Import / Cancel) card, confirm on the card;
• otherwise, type “Import” in the conversation.

These two ways of confirming do not give the same protection:

• A click on the card is signed. It is valid only for that request, for a few minutes. The assistant cannot click for you.
• A written confirmation goes through the assistant. It protects less than a click.
• For a written confirmation, Inventory · Remise requires “Import” or “Approve the import”. A vague answer is refused.
• Inventory · Remise then keeps in its log your message word for word, your name and the time, marked “relayé par l’assistant” (relayed by the assistant).

Questions asked by a tool follow the same rule:

• The answers you enter in a questions form are signed the same way. The tool knows they come from you.
• The answers you give in writing are recorded as relayed by the assistant.

See When a tool asks you questions.

Check that a document comes from TektonAI

Since October 17, 2026, every document our tools produce carries a mark of origin:

• PDF plan;
• CAD plan (DXF);
• 3D STEP model;
• Excel or CSV bill of materials;
• Inventory labels and slips;
• Materials catalogues.

The mark reads:

© 2026 TektonAI · Réf. TK-2026-… · Contrôle XXXX-XXXX

A QR code comes with it. It leads to a public verification page. The reference (Réf.) is also signed in the file’s metadata.

The verification page shows:

• whether the document is authentic;
• which company issued it, and when;
• the signed summary of its content: drawing number, revision, client, quantities, mass;
• the check code (Contrôle), to compare with the one on the document in your hands.

You can also drop the file you received there to find out whether it is identical to the original. The page never shows the document itself.

The page’s address takes this form:

https://mcp.tektonai.app/scaffold/verifier/<reference>
https://mcp.tektonai.app/inventory/verifier/<reference>
https://mcp.tektonai.app/materials/verifier/<reference>

A missing mark proves nothing, because a screenshot removes it. Only the verification counts.

Where your data is

Your data is hosted in Québec, in a data centre in Beauharnois. This includes:

• accounts and companies;
• files produced by our tools;
• databases and their backups.

The exceptions (website, payment, email, your AI assistant) are listed in section 8 of our privacy policy.

Your rights

Under Québec’s Law 25 and PIPEDA, you can:

• access your personal information;
• have it corrected;
• have it deleted.

See section 9 of the privacy policy.

Think you have found a security flaw? Write to us at info@tektonai.app.