Tenuta IQLast updated 20 October 2026.
Tenuta IQ, a product of Vcodi Pty Ltd, is in private preview. The public demo contains synthetic data only. Before any organisation puts its own portfolio into Tenuta IQ, we will agree its security, contractual and data-location requirements in writing. This page describes what the software and hosting do today, and lists separately what is planned.
What is in place today
- Hosting: the application runs on Amazon Web Services in Sydney, Australia (AWS Lambda for the application, Amazon DynamoDB for data, Amazon S3 for files), delivered through Amazon CloudFront. Traffic is served over HTTPS, and data is encrypted at rest by AWS.
- Sign-in without passwords: people sign in with passkeys (Face ID, Windows Hello and similar) or, once email is enabled, a one-time code. Sign-in tokens and sessions are stored only as one-way hashes; sessions expire and can be revoked.
- Separation between organisations: every record is stored under its organisation and every query is scoped to one organisation, so one organisation's requests cannot read another's records.
- Roles and scoped access: people see only what their role allows; outside advisers can be limited to a single lease and portal users to their own agreement.
- Audit trail: changes to leases and related records are recorded with who made them, when and which fields changed; sign-in events and platform changes are logged.
- Abuse protection: sign-in, forms and administrative access are rate-limited.
- Secrets: credentials are held in encrypted deployment settings (AWS and GitHub), not in the code. Deployments use short-lived credentials issued to our build pipeline; there are no long-lived access keys.
- Backups: the production database has DynamoDB point-in-time recovery turned on (restore to any second in the last 35 days). Restores have not yet been rehearsed; that is on the planned list below.
Planned before production onboarding
- Agreed data location for each customer, with regional hosting outside Australia where required
- Single sign-on (SAML or OpenID Connect) for customer staff
- Documented recovery objectives and a tested restore procedure
- Independent security testing
- A formal information security programme; Tenuta IQ holds no security certifications (such as ISO 27001 or SOC 2) today
- A published list of the service providers that process customer data
AI document processing
AI-assisted extraction of lease documents is in development and is not active in the demo. When it is, extracted values will be proposals with the page they came from, which a person must accept before they become part of the record, and customers will be told which providers process their documents.
Reporting a vulnerability
If you believe you have found a security issue, please tell us through our contact form, starting your message with "Security". Please do not access data that is not yours or disrupt the service while testing.