Privacy
What Tenon keeps, and why.
Effective 19 September 2026 · Tenon Works, LLC · [email protected]
Who this covers
This policy is written by Tenon Works, LLC, a Georgia limited liability company ("Tenon"). It covers two things: the public website at tenon.works, and the client room at deliverables.tenon.works and the Console at console.tenon.works, which Tenon's clients and their advisers sign in to. It does not cover the systems of a client's own business that Tenon works inside during an engagement; those are governed by the engagement agreement with that client.
Questions about this policy go to [email protected].
The public website
Reading tenon.works collects the following and nothing more.
- Server logs. The site runs on Railway behind Cloudflare. Both keep standard request logs: the address the request came from, the page requested, the time, and the browser identification string. Tenon uses them to keep the site running and to see which pages are read. They are not joined to a name.
- Error reports. When a page fails, a report goes to Sentry with the error, the page, and the browser identification string. Sentry does not receive form contents.
- The contact form. Sending a message gives Tenon the name, email address and message typed into the form. Cloudflare Turnstile checks that a person, not a script, sent it; Turnstile sets a short-lived token for that purpose only. The message is delivered to Tenon by email and kept for as long as the conversation it started.
- No advertising cookies, no analytics cookies, no tracking pixels. The site sets no cookie for a reader who does not sign in.
The client room and the Console
A person reaches the client room or the Console because a Tenon staff member added their work email address to an engagement's roster. Signing in verifies that the person controls that address through their organisation's identity provider (Microsoft) or through Google. Tenon keeps the following about a rostered person.
- Identity. The email address and display name the identity provider asserts at sign-in, and the provider's stable identifier for the account. Tenon uses them to match the person to the roster and to show their name in the room. A session cookie keeps the person signed in on that host; it carries no more than a signed session identifier.
- Reading activity. Which released documents the person opens and when, and the first open of each released version, which tells the Tenon team the document reached its reader. Downloads of a document's PDF are recorded the same way.
- Comments. Where the room offers comments, anything the person writes there, attributed to them and visible to the Tenon team and to the people the comment was shared with.
- Access logs. The standard request logs described above, on Amazon Web Services and Cloudflare, which include the address a page was opened from and the sign-in address when it appears in an invitation link.
- Invitations and releases. The fact that a document was released to the person by name, when, and until when, which the person can see on their own room home.
Sign in with Google uses Google's basic profile scopes only (openid, email, profile). Tenon reads the address and name to match the roster and stores nothing else from the Google account. Tenon does not read Google Drive, Gmail, Calendar or any other Google data through this sign-in, and the sign-in grants Tenon no access to them.
Sign in with Microsoft works the same way with a Microsoft Entra work account: Tenon receives the address, the name and the account identifier from the person's own organisation, and nothing else.
Client engagement material
The documents in a client room, and the material a client shares with Tenon during an engagement, belong to the client and are handled under the engagement agreement, which controls over this policy for that material. In broad terms: client material is stored in Tenon's AWS account in the United States, or in a dedicated AWS account for that client when the agreement calls for one; it is encrypted at rest and in transit; and access is limited to the Tenon staff working on that engagement and to the people the client has rostered. Where Tenon uses an AI model to work on client material, the model provider processes it under a data-processing agreement that prohibits training on it.
How long Tenon keeps it
- Website server logs and error reports: up to ninety days.
- Contact form messages: for as long as the conversation they started, then deleted on request.
- Roster entries, sign-in identities and reading activity for a client room: for the life of the engagement, then as the engagement agreement provides. A person removed from a roster loses access at once; the record that they were rostered is kept as part of the engagement's audit trail.
- Session cookies: the signed-in session lasts one hour and renews itself for up to thirty days, or until sign-out, whichever comes first.
Your rights
Anyone may ask Tenon what it holds about them, ask for a correction, or ask for deletion, by writing to [email protected]. Tenon answers within thirty days. Where the data is part of a client engagement's record, Tenon may need the client's agreement to delete it, and will say so. A person who signed in with Google can also remove Tenon from their Google account's connected apps at any time, which ends Tenon's ability to verify that address through Google and nothing else.
Tenon's services are for businesses and are not directed at children. Tenon does not knowingly collect data from anyone under sixteen.
Changes to this policy
This version took effect on 19 September 2026. When the policy changes in a way that matters to the people it covers, Tenon updates the date here. Earlier versions are available on request.