Security Whitepaper

Security Overview

Security is fundamental to everything Ternio builds. The Ternio App provides a mobile authentication gateway for contact center platforms, and our entire architecture is designed around a single principle: store as little as possible, protect everything we do store, and never touch data that isn't ours.

Our security posture is built across three dimensions:

People

• All employees undergo background verification before being assigned access to sensitive systems
• Mandatory security awareness training at onboarding and on an ongoing basis
• All employees sign confidentiality agreements and acceptable use policies upon joining
• Annual policy reviews ensure training and procedures remain current

Process

• Formal change management policy governing all production deployments
• Secure Software Development Lifecycle (SDLC) with mandatory code review
• Quarterly security assessments and internal audit cycles
• Documented incident response procedures with defined escalation paths

Technology

• AES-256 encryption at rest with unique per-tenant salt keys
• TLS 1.2+ encryption in transit with HSTS enforcement
• Microsoft Azure enterprise infrastructure with redundant architecture
• Least-privilege access controls and mandatory two-factor authentication for production environments

Data Architecture

Ternio's fundamental security advantage is our data minimization architecture. We operate as an authentication gateway — not a data processor. The less data held, the smaller the attack surface.

Authentication Flow

When an agent logs in, only their encrypted username is transmitted to Ternio servers for license verification. The agent's password never leaves the device and is never transmitted to or stored by Ternio. Once authentication is verified, all subsequent communication flows directly between the mobile app and the contact center platform. Ternio is no longer in the data path.

What We Store

All stored data is encrypted using AES-256 with a unique per-tenant salt key. No stored data is readable to anyone with server access alone, and no stored data is usable without decryption combined with the user's password — which Ternio does not hold.

• Agent username (first and last name) — for license verification
• User ID credentials — for license verification
• API keys and API secrets — for contact center authentication, encrypted at rest
• Business unit identifier — for contact center identification

What We Never Store

Encryption Standards

Data at Rest

All data stored on Ternio servers is encrypted using 256-bit Advanced Encryption Standard (AES-256). Encryption keys are managed via an in-house Key Management Service (KMS). Each customer tenant is assigned a unique salt key generated at registration, ensuring logical separation at the encryption layer. No two tenants share key material.

Data in Transit

All connections to Ternio servers over public networks require Transport Layer Security (TLS) version 1.2 or higher. This applies to all web access, API access, and mobile app communications. HTTP Strict Transport Security (HSTS) is enforced on all web connections, instructing browsers to connect exclusively over encrypted channels. All authentication cookies are flagged as Secure.

Tenant Isolation

Each customer's data is logically separated from other customers' data using unique encryption keys and access control protocols. No customer's data is accessible to another customer, at either the application layer or the encryption layer.

Infrastructure Security

Cloud Infrastructure

All Ternio services are hosted exclusively on Microsoft Azure in the South/Central US region (Texas). No customer data leaves the United States. Azure provides enterprise-grade physical security, environmental controls, and infrastructure compliance — including SOC 2 Type II and ISO 27001 certifications at the infrastructure layer. Ternio inherits these infrastructure-level assurances.

Redundancy and Availability

• All platform components are redundant using a distributed grid architecture
• Cross-data center replication occurs in near real-time
• Azure Load Balancer provides automatic scaling under increased load
• Multiple ISPs at all data center locations eliminate single points of network failure
• 99.9% monthly uptime SLA for the Ternio App

Backup and Data Retention

Full backups run weekly. Backup data is encrypted at rest using AES-256 and retained for 30 days. All operational data is automatically wiped after 30 days by default. Customers may request shorter retention windows or immediate manual deletion at any time.

Disaster Recovery

Application data is stored on resilient Microsoft Azure storage replicated across data centers. In the event of a primary data center failure, the secondary data center assumes operations with minimal interruption. Given that Ternio stores only encrypted credentials rather than large data sets, full restoration is achieved well within defined recovery thresholds.

Access Control

Internal Access Controls

Ternio employs strict least-privilege and role-based access controls across all systems. Access to production environments requires strong passwords and two-factor authentication (2FA). Internal policies explicitly prohibit arbitrary employee access to customer data. Access rights are reviewed and updated whenever employee roles change.

Tiered Access Model

Production system access is restricted to authorized personnel based on role and operational need. Developers have access scoped to their specific technical domain. Full system access is limited to designated senior personnel. All access to production environments is logged.

End-User Authentication

Agents access the Ternio App using the same credentials they hold on their contact center platform — no separate Ternio password is required or created. Ternio validates the username for license verification, then the contact center platform handles full authentication and generates a unique single-use security token valid for that session only. Tokens expire immediately upon logout and are never stored by Ternio.

Endpoint Security

All Ternio workstations run current, fully patched operating systems and are configured with anti-virus and endpoint protection software. Workstations enforce strong password requirements and auto-lock after a period of inactivity. Use of the Ternio App on jailbroken or rooted devices is strictly prohibited and results in immediate termination of the user's license.

Operational Security

Vulnerability Management

Identified vulnerabilities are logged, prioritized by severity, assigned to an owner, and tracked to closure with documented corrective actions. Ternio leverages Microsoft Azure's managed server scanning as a core component of its vulnerability management program. Critical vulnerabilities are remediated within defined timeframes based on severity classification.

Secure Development

Our Software Development Lifecycle (SDLC) mandates adherence to secure coding guidelines, mandatory peer code review, and static analysis tooling on all code changes. Every change and new feature is governed by a formal change management policy requiring authorization before deployment to production. Deployment to production requires documented approval through a structured workflow.

Logging and Monitoring

Ternio collects and analyzes event logs, audit logs, fault logs, and administrator logs across services and infrastructure. Logs are stored in a secure environment isolated from full system access. Anomaly detection and alerting are active for critical security events. Log data is retained for review and available as supporting evidence for security inquiries upon request.

Malware and Endpoint Protection

Ternio's application infrastructure runs on Microsoft Azure managed servers, which include multi-layer anti-virus and malware protection maintained and updated by Microsoft. Internal workstations use enterprise endpoint protection aligned with Azure security standards and are updated automatically as new definitions are released.

Incident Management

Response Process

Ternio maintains a formal incident response process. All security incidents are logged, assessed for scope and impact, assigned to an owner, and tracked to resolution with documented corrective actions. Where applicable, supporting evidence is provided to affected customers upon request.

Notification Timelines

• Affected customers are notified without undue delay and within 48 hours of Ternio becoming aware of an incident
• Relevant data protection authorities are notified within 72 hours as required under GDPR Article 33
• For general service incidents, customers are notified through standard communication channels as soon as feasible

Incident History

No data breaches or security incidents involving customer data have occurred in the past five years.

Reporting a Security Concern

To report a security vulnerability or concern, contact support@ternio.com. Security reports are treated with the highest priority and acknowledged within one business day.

Compliance

Ternio's data minimization architecture significantly reduces regulatory complexity. The following table summarizes Ternio's compliance posture across relevant frameworks.

Framework Status

Infrastructure Compliance

Ternio's hosting infrastructure on Microsoft Azure carries SOC 2 Type II, ISO 27001, and FedRAMP certifications at the infrastructure layer. Ternio inherits these assurances for physical security, environmental controls, and network infrastructure.

Security Inquiries

Enterprise customers and security teams requiring information beyond this whitepaper — including formal security questionnaire responses, architecture documentation, or evidence packages — are welcome to contact us directly. We respond to enterprise security questionnaires as a standard part of our sales and onboarding process.