Developer features
A public REST API with API keys, HMAC-signed webhooks with retries, custom fields and deployment self-tests.
Explore
Tenant isolation enforced by the database, not by hope.
Tenant isolation enforced by the database, not by hope.
Every table in Tenon carries Row Level Security policies scoped to the organization. The same isolation that keeps Tenon Cloud customers apart keeps your departments or clients apart when you self-host. Add SAML or OIDC single sign-on per organization, see and revoke sessions, review activity logs, and run a self-test that proves it.
-- Every table. Every query. Enforced by the database.
alter table tickets enable row level security;
create policy "tickets: org members only"
on tickets for all
using (
org_id = auth.current_org_id()
or auth.is_superadmin()
);
-- A bug in the app cannot leak another tenant's rows.
Why it matters
Most multi-tenant apps protect your data with an "if" statement.
In a typical multi-tenant SaaS, tenant isolation is application logic: every query is supposed to include WHERE org_id = ?. One forgotten clause, one clever URL, and a customer sees another customer's data. These are among the most common breaches in the industry, and they're almost always a bug, not an attack.
Tenon moves that rule into Postgres itself. Row Level Security policies are attached to every table, so the database refuses to return rows that don't belong to the caller's organization, regardless of what the application asks for. A superadmin role exists for cross-tenant administration, and it is explicit and auditable.
The rest of the security surface is what your IT team will ask for in the questionnaire: SAML and OIDC identity providers per workspace, Google OAuth, email/password via Supabase Auth (GoTrue), active-session listing with one-click revocation, per-user activity logs, and a change-password flow that doesn't require a support ticket. On Tenon Cloud the answer to "where does the data live?" is the EU or US region you chose; self-hosted, it's wherever you put it.
What you get
Security, item by item.
Email, password & Google
Supabase Auth (GoTrue) handles email/password sign-in plus Google OAuth out of the box.
Row Level Security everywhere
Org-scoped, superadmin-aware policies on every table. A query cannot return another tenant's rows, even if application code has a bug.
SAML & OIDC identity providers
Add identity providers per workspace with a setup-instructions drawer and copyable config fields.
Active sessions
See where you are signed in and revoke any session with one click.
Activity log
A per-user log of what happened, when.
Password & security settings
Change-password flow and general security settings without a support ticket.
Onboarding tour
A guided welcome and tooltips for new users, with progress saved per section.
Single sign-on
SSO that takes an afternoon, not a project.
Add an identity provider per workspace from Settings. A setup-instructions drawer shows exactly what your IdP needs (ACS URL, entity ID, redirect URI) with copy buttons on every field.
- SAML 2.0Okta, Azure AD / Entra, OneLogin, Ping, ADFS and any SAML IdP.
- OIDCGoogle Workspace, Auth0, Keycloak, Authentik and other OpenID Connect providers.
- Per-workspaceDifferent tenants can use different identity providers on one deployment.
Active sessions
Every user sees where they are signed in and can revoke any session instantly.
Activity log
A per-user record of what happened and when, kept in your database.
RLS self-test
An edge function that attempts cross-tenant reads and reports that they fail. Run it after every deploy.
Superadmin panel
Cross-tenant administration, AI provider configuration and admin broadcasts, explicit and logged.
A Tuesday afternoon with Tenon
Passing the security review without a single custom answer.
The prospect's security questionnaire arrives: 84 questions. Where is data stored? In our own Postgres, in our region. Tenant isolation? Row Level Security on every table; here is the self-test output from Friday. SSO? SAML through our Okta, configured per workspace. Session management? Users revoke their own; admins see activity logs. Subprocessors? None for this system.
Tomas finishes the questionnaire in an afternoon, attaches the RLS self-test report, and moves on. The AI question, "does any data leave your environment?", gets a one-word answer, because the model runs on their own hardware.
Tomas, IT security lead, healthcare services group
Questions
Common questions.
What is Row Level Security?
A Postgres feature that attaches access policies directly to tables. Every query, from the app, an API, or the AI assistant, is filtered by those policies before any rows are returned. Tenon enables it on every table with org-scoped, superadmin-aware policies.
Which identity providers work?
Any SAML 2.0 or OIDC provider: Okta, Microsoft Entra ID, Google Workspace, OneLogin, Keycloak, Auth0, Authentik, ADFS and more.
Can I disable password login and require SSO?
Yes. Enforce SSO per workspace once your identity provider is connected.
Is there 2FA?
Multi-factor authentication is enforced by your identity provider when using SSO. Supabase Auth also supports MFA for email/password accounts.
How do I verify isolation on my deployment?
Run the built-in RLS self-test edge function. It attempts a set of cross-tenant reads and writes and reports that each is denied, evidence you can attach to an audit.
Fits together with
The rest of the joint.
Workspace insights
Portfolio health, resource heatmaps, C-suite metrics and an AI executive summary across every project in the organization.
ExploreBrain, the AI assistant
A floating assistant that knows your projects and tickets, drafts work for you, writes the morning briefing, and runs on the AI provider you choose.
ExploreBring every piece of work into one place.
Start free on Tenon Cloud in two minutes, no credit card. Or host it yourself for your departments and clients.