Built for trust & safety, legal, and engineering teams scaling child-safety operations. Tuteliq provides enterprise child safety API security with zero content retention, EU data residency, and incidents encrypted using RSA-OAEP wrapped AES-256-GCM keys that only you can decrypt. SOC 2 Type II attestation and ISO 27001 certification are in progress.
Security questionnaire quick answers
Do you store customer content?
No. Content is processed in memory and deleted immediately after analysis (zero content retention).
Where is data processed?
EU only. Inference runs in Paris (Mistral) and EU data centers (Whisper via Vertex AI EU).
How are incidents encrypted?
AES-256-GCM with an RSA-OAEP wrapped key generated in your browser — Tuteliq cannot decrypt your incidents.
Which certifications do you hold?
SOC 2 Type II and ISO 27001 audits are in progress, not yet issued. Controls are already implemented.
Child-safety regulation support?
Controls aligned with KOSA duty-of-care requirements and COPPA data-minimization for children under 13.
Do you support age assurance?
Yes. Age and identity verification with configurable age thresholds, and verification data encrypted with AES-256-GCM.
Session and access controls?
30-minute inactivity timeout by default, optional 12-hour extension; MFA (TOTP) and role-based access available.
1. Executive Summary
Tuteliq provides enterprise-grade security for child safety APIs, combining zero-storage processing with controls aligned to SOC 2 Type II and ISO 27001. Our architecture removes the largest attack surface: stored customer content.
Key Commitment: We process customer data in real-time and delete it immediately. Because we don't retain customer data, we significantly reduce security exposure for platforms scaling child-safety operations.
2. Security Architecture
2.1 Data Flow Security
Encrypted Submission → Real-Time Processing → Immediate Deletion
2.2 Encryption Standards
In-Transit Encryption:
- TLS 1.3, with TLS 1.2 enforced as the minimum
- 256-bit minimum key length
- Forward secrecy enabled
- Certificate pinning for sensitive endpoints
- All API communications encrypted
Data at Rest Encryption:
- AES-256 at rest across the database and storage layer
- Account data: Encrypted with Tuteliq master keys
- Billing data: Encrypted with Tuteliq master keys
- Incident reports: Encrypted with customer's private key
- Customer Content: Not stored (deleted immediately)
Incident Encryption:
- RSA-OAEP key pair generated in your browser; the private key never leaves your device
- Tuteliq never has access to customer key
- Encryption happens before return
- Only customer can decrypt incidents
- Scheme: RSA-OAEP wrapped AES-256-GCM data key (hybrid envelope)
2.3 Key Management
Tuteliq Master Keys:
- Hardware security module (HSM) protected
- Redundant key storage
- Regular key rotation (annually)
- Access restricted to authorized personnel
- Audit logging of all key operations
Customer Encryption Keys:
- Generated by customer (you control)
- Never transmitted to Tuteliq
- Never logged or stored by Tuteliq
- You manage backup and recovery
- Tuteliq has no recovery mechanism (by design)
3. Access Control
3.1 Role-Based Access Control (RBAC)
Access Levels:
- Admin: Full system access (configuration, personnel management)
- Operations: Infrastructure management (monitoring, incident response)
- Development: Code deployment, testing (no production data access)
- Support: Customer support (limited, incident-based access)
- Security: Security monitoring and audit (read-only)
Principle of Least Privilege:
- Each role has minimum necessary permissions
- Access regularly reviewed
- Unnecessary access revoked
- Regular access audits (quarterly)
3.2 Authentication
Admin & Sensitive Access:
- Multi-factor authentication (MFA) mandatory
- Supported methods: TOTP, hardware tokens, SMS
- No single-factor authentication for sensitive systems
- Failed login attempts logged
Application Access:
- API authentication: Customer API key or OAuth 2.0
- Session tokens: 8-hour maximum duration
- Automatic timeout: 30 minutes of inactivity
- Token rotation on re-authentication
3.3 Audit Logging
All Access Logged:
- Who accessed what (user, system, resource)
- When access occurred (timestamp)
- What actions were taken
- Whether access succeeded or failed
- Source IP address
- MFA method used
Retention:
- Security audit logs retained 90 days (minimum); API request logs 30 days
- Critical security logs retained 1 year
- Logs encrypted at rest
- Logs immutable (cannot be modified)
4. Infrastructure Security
4.1 Cloud Infrastructure
Provider: Google Cloud Platform (Europe region, Frankfurt, Germany)
Security Controls:
- Firewall (inbound/outbound traffic filtering)
- DDoS protection (built-in GCP protection)
- Intrusion detection system (IDS)
- Intrusion prevention system (IPS)
- Network segmentation (separate subnets per tier)
- VPC isolation (private cloud network)
Datacenters:
- Location: Frankfurt, Germany (EU/EEA)
- Physical security: Controlled access, cameras, alarm systems
- Fire suppression: Automatic systems
- Power redundancy: N+2 redundancy, backup generators
- Climate control: Automated temperature/humidity management
4.2 Database Security
Database Isolation:
- Separate database cluster (not shared)
- No internet-facing database
- Private network access only
- Connection through restricted API
Database Encryption:
- Encryption at rest (AES-256)
- Encryption in transit (TLS 1.3, TLS 1.2 minimum)
- Automated backups encrypted
- Backup access restricted
Important: Customer data is not stored in databases (deleted immediately after processing).
4.3 API Gateway Security
Rate Limiting:
- Per-customer rate limits (configurable)
- Prevents abuse and DDoS
- Graceful degradation under load
Input Validation:
- All inputs validated against schema
- Maximum size limits enforced
- Malicious input blocked
- Error messages don't leak information
WAF (Web Application Firewall):
- OWASP Top 10 protections
- SQL injection prevention
- Cross-site scripting (XSS) prevention
- CSRF token validation
5. Vulnerability Management
5.1 Security Testing
Automated Scanning:
- Weekly static code analysis (SAST)
- Weekly dynamic scanning (DAST)
- Continuous vulnerability scanning
- Dependency scanning (open source libraries)
Manual Testing:
- Quarterly penetration testing (external firm)
- Annual comprehensive security audit
- Code review security focus (100% of code)
- Third-party assessment (annually)
5.2 Vulnerability Disclosure
Responsible Disclosure Policy:
Our full Vulnerability Disclosure Policy is published at /vulnerability-disclosure. It includes scope, safe harbor, rules of engagement, response timelines, and an embedded HackerOne submission form.
- Security researcher finds vulnerability
- Reports via the HackerOne form or to security@tuteliq.ai
- We acknowledge receipt (within 24 hours)
- We provide timeline for fix (usually 30 days; critical within 7 days)
- We fix and deploy patch
- We notify researcher and customers
- We credit the researcher (with permission)
No Public Disclosure Until:
- Fix is deployed
- Customers are notified
- Patch is available
- Minimum 90 days from discovery
5.3 Patch Management
- Security patches deployed within 7 days of availability
- Critical patches deployed within 24-48 hours
- All patches tested before production deployment
- Automatic updates for non-customer-impacting patches
6. Incident Response
6.1 Security Incident Response Plan
Detection
- Automated monitoring (24/7)
- Security team on-call
- Suspicious activity alerts
Containment
- Isolate affected systems (within 1 hour)
- Preserve evidence
- Assess scope and impact
- Determine if customer data affected
Investigation
- Root cause analysis
- Timeline reconstruction
- Identify affected systems
- Determine data exposed (if any)
Remediation
- Fix underlying vulnerability
- Deploy patch
- Remove attacker access
- Verify systems are secure
Notification
- Notify affected customers (within 24-48 hours)
- Provide incident summary
- Explain what was exposed
- Provide remediation steps
- Offer support
Recovery
- Restore systems to normal
- Monitor for suspicious activity
- Verify incident is resolved
- Post-incident review (lessons learned)
6.2 Incident Response Timeline
Phase
Timeline
Details
Immediate
Automated systems alert security team
24 hours
Determine scope and impact
24-48 hours
Notify affected customers
48-72 hours
Fix and deploy patch
72+ hours
Full system recovery and verification
Communication
Ongoing
Updates provided as work progresses
7. Compliance Framework
7.1 GDPR, COPPA, KOSA and Online Safety Act Compliance Controls
GDPR (General Data Protection Regulation - EU):
- Article 28 compliance (Processor obligations)
- Article 32 compliance (Security requirements)
- Article 33 compliance (Breach notification)
- DPA executed with all customers
- Data Protection Impact Assessment (DPIA) completed
- Data Protection Officer (DPO) appointed
CCPA/CPRA (California Privacy Rights):
- Consumer rights honored
- No sale of personal information
- Transparency regarding collection
- Data deletion on request
COPPA (US Children's Privacy):
- Parental consent mechanisms
- Child data immediately deleted
- No marketing to children
- No data sharing for targeted ads
KOSA (Kids Online Safety Act - US):
- Age-appropriate content handling
- Child safety features
- Parental involvement supported
- Platform accountability
UK Online Safety Act:
- Harmful content detection
- Child protection measures
- Duty of care to users
- Transparency requirements
Swedish Data Protection Act (Dataskyddslagen 2018:218):
- Swedish GDPR implementation compliance
- Organization registration with authority
- Regular compliance audits
7.2 SOC 2 Type II and ISO 27001 Compliance Roadmap
Enterprise child-safety API procurement teams routinely ask for evidence of independent assurance before integrating detection services. We are actively working toward both SOC 2 Type II attestation and ISO 27001 certification so that trust & safety, legal, and InfoSec reviewers can evaluate Tuteliq against the same standards they apply to their other critical vendors.
SOC 2 Type II
- Status: Attestation in progress, not yet issued
- Type I audit scheduled: October 2026
- Scope: Security, Availability, Confidentiality, Integrity
- Covers: API infrastructure, access control, change management, incident response
ISO 27001
- Status: Certification in progress, not yet issued
- Stage 1 audit scheduled: November 2026
- Scope: Information Security Management System (ISMS)
- Covers: Risk assessment, asset management, supplier controls, continuous improvement
What this means for child-safety API buyers:
- No certification is claimed today; both programs are in active progress with scheduled audit dates
- Controls are designed around zero content retention, reducing the audit scope for customer data
- EU-hosted inference and Frankfurt relay align with data-residency requirements common in European InfoSec reviews
- RSA-OAEP wrapped AES-256-GCM incident encryption is documented for assessor review
- Detailed status, evidence pack, and auditor letters available under NDA upon request
Controls already in place ahead of attestation:
- Mandatory MFA for all production and administrative access
- Role-based access control with quarterly access reviews
- Encrypted backups with restricted access and tested recovery procedures
- Documented incident response plan with 24–48 hour customer notification
- Annual penetration testing and weekly automated security scanning
- Vendor security assessments for GCP, Supabase, Stripe, and other sub-processors
NIST Cybersecurity Framework alignment:
- Aligned with NIST CSF
- Identify, Protect, Detect, Respond, Recover
- Regular self-assessments
7.3 Industry Standards
PCI DSS (Payment Card Industry Data Security Standard):
- Relevant to payment processing only
- Stripe handles PCI compliance (we don't store cards)
- No direct applicability (we don't store payment data)
HIPAA (if processing health data):
- If customers use Tuteliq for health data, HIPAA may apply
- Customers are responsible for HIPAA compliance
- Tuteliq is processor under BAA (available upon request)
7.4 Child Safety and Harmful Content Reporting
Tuteliq provides AI-powered detection to help platforms identify CSAM, child exploitation and grooming, bullying and harassment, scams and fraud, and self-harm content.
Reporting responsibility:
Tuteliq is a detection and analysis platform. Customers are legally responsible for reporting detected harmful content to authorities. We do not report automatically. CSAM detections must typically be reported to NCMEC (USA), the IWF (UK/EU) or local authorities within 24–48 hours.
What we do not do:
- Store any content processed
- Retain detection history
- Automatically report to authorities
- Decrypt your incident reports (you hold the key)
Internet Watch Foundation (IWF) membership:
- Tuteliq is a member of the Internet Watch Foundation
- Commitment to child safety and protection
- Alignment with international best practices
- Support for law enforcement cooperation
Reporting channels: IWF (international), NCMEC CyberTipline (USA), or your national law enforcement agency.
8. Third-Party Security
8.1 Sub-Processor Security
All sub-processors required to maintain:
- Equivalent security controls
- Data encryption (in transit and at rest)
- Access controls and authentication
- Regular security audits
- Incident response procedures
- Breach notification obligations
Current Sub-Processors:
- Google Cloud Platform: SOC 2 Type II certified, ISO 27001 certified
- Supabase: SOC 2 Type II certified, standard security controls
- Stripe: PCI DSS certified, payment card compliance
See our Sub-processors list for full details.
8.2 Vendor Management
Vendor Security Assessment:
- Security questionnaire review
- Compliance certification verification
- Data handling practices review
- Access control evaluation
Ongoing Monitoring:
- Quarterly compliance verification
- Security incident notifications
- Annual re-certification
- Regular audits of third-party access
9. Data Protection Best Practices
9.1 Your Responsibilities
Before Submission:
- Verify you have authority to process the data
- Have appropriate legal basis (consent, legitimate interest, etc.)
- Obtain necessary parental consents (for children)
- Inform data subjects (privacy notice)
During Processing:
- Use Tuteliq only for authorized purposes
- Secure your encryption key
- Monitor incident reports
- Take appropriate action on detected threats
After Processing:
- Manage incident reports securely
- Comply with data subject rights requests
- Maintain audit trail of processing
- Delete incidents when appropriate
9.2 Encryption Key Management
Your Encryption Key:
- You generate and control it (we don't have it)
- Securely back it up (we can't recover it)
- Protect access to it (we can't access incidents if key is lost)
- Rotate it periodically (for security)
- Never share it (keep it absolutely secret)
If You Lose Your Key:
- Incidents cannot be recovered or decrypted
- Tuteliq cannot decrypt them (by design)
- Data is effectively lost
- Future incidents can be generated with new key
10. Monitoring and Maintenance
10.1 System Monitoring
Uptime Monitoring:
- Continuous monitoring (24/7)
- Automated alerting
- Response SLA: 15 minutes for critical alerts
- Public status page: status.tuteliq.ai
Performance Monitoring:
- API response time tracking
- Throughput monitoring
- Error rate tracking
- Database performance analysis
10.2 Maintenance Windows
Scheduled Maintenance:
- Announced 24 hours in advance (when possible)
- Typically 2 AM - 4 AM UTC (off-peak hours)
- Estimated duration provided
- Automatic failover during maintenance
- Backup systems online
Target Uptime: 99.5% monthly uptime
Maximum Downtime: 3.6 hours per month (based on SLA)
11. Security Training
11.1 Employee Training
All Employees
- Annual security awareness training
- Password security and hygiene
- Social engineering awareness
- Data protection principles
- Incident reporting procedures
Development Team
- Secure coding practices
- OWASP Top 10 training
- Security code review
- Vulnerability identification
Operations/Security
- Advanced security topics
- Forensics and investigation
- Compliance requirements
11.2 Customer Training
We provide security guidance:
- Best practices for API integration
- Encryption key management
- Incident report handling
- Threat response procedures
- Documentation and tutorials
12. Disaster Recovery and Business Continuity
12.1 Backup Strategy
Data Backups:
- Automated daily backups
- Geographically distributed (multiple regions)
- Encryption of backups (AES-256)
- Regular restore testing
Important: Customer content is not backed up (deleted immediately after processing).
12.2 Disaster Recovery
Recovery Time Objective (RTO): 4 hours (maximum)
Recovery Point Objective (RPO): 1 hour (maximum data loss)
Disaster Scenarios:
- Datacenter failure: Fail over to backup region
- Natural disaster: Backup datacenter in different region
- Ransomware: Backups isolated and encrypted
- Cybersecurity incident: System rebuild from backups
13. Contact and Support
13.1 Security Issues
Report Security Vulnerability: security@tuteliq.ai, Response within 2 business days. Use responsible disclosure process.
Security Questions: security@tuteliq.ai, Response within 5 business days.
Security Incident: security@tuteliq.ai (mark "URGENT"), Response within 1 hour. Phone: Emergency contact provided to customers.
13.2 Compliance Questions
GDPR/Privacy Questions: dpo@tuteliq.ai, Response within 10 business days.
Compliance Verification: compliance@tuteliq.ai, Status details on SOC 2 Type II (in progress) and ISO 27001 (in progress) available; NDA may be required.
14. Summary
Tuteliq's Security Commitment:
- Zero-storage model eliminates stored data risk
- Encryption at every stage (in transit, at rest, in incidents)
- Strong access controls and authentication
- 24/7 monitoring and incident response
- Regular security testing and audits
- SOC 2 Type II, in progress; ISO 27001, in progress
- GDPR and CCPA compliant; COPPA and KOSA aligned
- Transparent about security practices
Your Security Responsibility:
- Control access to incidents
- Take action on detected threats
- Maintain compliance with your legal obligations
Together: Tuteliq provides secure processing; you manage incidents responsibly.
Security is a continuous process. We regularly review and update our security measures to address emerging threats. For security questions, contact security@tuteliq.ai.
See also our Privacy Policy, Data Processing Agreement, and Sub-processors.