Security

Last updated October 3, 2026

Tend reads and acts in the accounts you connect, so protecting them is the first job. This page explains how your data and your connected accounts are protected today.

Your connected accounts

• You connect an app on that app's own sign-in page, and you choose there what Tend may access.
• The access tokens an app grants are held by our connection providers, Composio and Nango. Tend's own database stores none of them.
• Tend asks for your confirmation before any action that changes something in a connected account, and records every action it takes in an activity log you can see.
• You can disconnect any app at any time, which ends Tend's access at once.

Data in transit

All traffic to heytend.me is served over HTTPS; plain HTTP is redirected to HTTPS.

Data at rest

• Tend runs on Fly.io in the United States. Its storage volumes are encrypted at rest.
• Items you save in your vault, such as logins and addresses, are additionally encrypted with AES-256-GCM, each bound to your account.
• Vault details are filled into websites for you without being shown in your conversations or to the AI model.

Sign-in

You sign in with a one-time six-digit code sent to your phone. Codes expire after 10 minutes and allow a limited number of attempts.

Separation and access

• Each person's data is kept under their own account, and every private request to Tend's API is authenticated.
• Webhooks from connected services are verified by their signatures before Tend acts on them.
• Tend's own keys and credentials are kept as encrypted secrets on our host, not in our code.

Service providers

Tend relies on established providers for hosting, AI models, messaging and account connections. Each receives only what it needs to do its part; they are listed in our Privacy Policy.

Reporting a vulnerability

If you find a security issue, please email hello@heytend.me with the details. We will respond promptly and ask that you give us reasonable time to fix it before sharing it publicly.