Trust
Security
Tempa is one shared installation that keeps each organisation's configuration, people, secrets, audit log and telemetry apart. These are the measures in place.
How Tempa protects your data
Tenants kept apart by the database
Every organisation's rows live behind forced row-level security in Postgres. The tenant comes from the signed-in session, not from each query, and a request without one sees no rows at all. Tests prove each of these rules on every change.
Secrets encrypted, keys in a vault
The credentials you give Tempa (Git tokens, deploy keys, webhook and MCP secrets) are envelope-encrypted in the database; the key that unlocks them, and every installation secret, is in Scaleway's secret manager.
An audit log that shows tampering
Every configuration change, role and sign-in is written to an append-only log: the database refuses changes and deletions, and each organisation's entries form a hash chain.
Telemetry with pseudonyms
Usage telemetry is pseudonymised per organisation on arrival; prompt text and tool details are dropped unless you switch them on for a team. Rows expire after the retention you set, and dashboards never go below team level.
Sign-in and sessions
Microsoft, Google, GitHub or an e-mail link, as your organisation allows; your login policy can require multi-factor authentication and limit how long a sign-in lasts. Web sessions are signed, http-only cookies; device tokens can be revoked by an admin.
Hardened web app
Access tokens stay on the server: the web app calls the API for you, so the browser never holds one. Pages cannot be framed, content types are not sniffed and no URL leaks to other sites as a referrer. All traffic uses TLS.
Hosted in the EU
Tempa runs on Scaleway, a European cloud provider, in its EU regions, and is run by Devleaps, a Dutch company.
Tempa's guardrails run in each developer's own coding agent: a control for teams that work in good faith, with an audit trail, not a barrier against someone determined to get around it on their own laptop. Lock-down packs for device management make Tempa's hooks mandatory where you need that.
Security policy
Tempa is Devleaps' control plane for coding agents: one shared installation that keeps each company's (tenant's) config, people, secrets, audit log and telemetry apart. We take reports about that boundary, and about anything else in Tempa, seriously.
Reporting a vulnerability
Report it privately, never in a public issue, pull request or chat.
- Where: the contact in
https://tempa.devleaps.nl/.well-known/security.txt(RFC 9116). - What to send: what you found, the steps to reproduce, the affected URL or component, the impact you expect (in particular whether one tenant can reach another's data), and how to reach you.
- Please do not access, change or keep data that is not yours, degrade the service, or test production beyond what your own account may do. Stop at the proof and tell us.
What happens next
| When | What |
|---|---|
| 3 working days | We confirm we received it |
| 10 working days | Our first assessment and severity |
| 90 days | Target to fix and disclose together; sooner for critical findings, later only by agreement |
We credit reporters who want to be credited once the fix is out. We do not take legal action against good-faith research that follows this policy and the rules in docs/security/pen-test-scope.md (no production disruption, no data of others, no social engineering).
Scope
In scope: tempa-web and tempa-api at tempa.devleaps.nl, the tempa CLI and its plugins, and this repository. Out of scope: third-party services Tempa uses (Scaleway, GitHub, Microsoft Entra, Google, Anthropic), volumetric denial of service, and bypassing Tempa's guardrails on your own laptop (client-side by design).
Supported versions
Only the latest release of tempa-api, tempa-web and the CLI receives security fixes.
More
- How Tempa keeps tenants apart, threat by threat: docs/security/threat-model.md
- Pen-test scope and rules of engagement: docs/security/pen-test-scope.md