How TUTELA protects your data

1 · Architecture principle

TUTELA is engineered around one uncompromising rule: private where it must be, connected where it helps. The system is split into two strictly separated trust domains, each with its own storage, its own ownership and its own key control:

2 · The personal domain — CRAWLit, local-first

2.1 Local storage

• All CRAWLit data — messages, contacts, conversation history, private notes and priority board state — is stored on the owner's own computer. There is no TUTELA-operated cloud copy of personal communications.
• The local data store is encrypted at rest with AES-256; the encryption key is derived from the owner's credentials and never transmitted.
• Channel connections (SMS, email, WhatsApp, direct messages) terminate on the owner's machine. TUTELA servers are not a relay for personal message content.

2.2 Encrypted history & guided recovery

• Local history is kept in an encrypted, integrity-checked journal so a corrupted record can be detected and repaired.
• Guided recovery lets the owner restore history from an encrypted local backup using their recovery phrase. The recovery phrase is generated on-device and is never known to TUTELA.
• Losing the recovery phrase means TUTELA cannot decrypt the backup for you — by design. Nobody else can either.

3 · The company domain — a cloud boundary the company owns

3.1 Ownership and billing

• The commercial components run inside a TUTELA-specific boundary provisioned in the company's own cloud account (AWS). The company contracts and pays the cloud provider directly.
• TUTELA adds no markup on cloud costs and holds no ownership over the account, the data or the keys.
• The company can revoke TUTELA's operational access at any time; the data remains in the company's account.

3.2 Isolation and encryption

• Each company's boundary is single-tenant: no shared databases, no shared storage, no cross-company queries are possible by construction.
• Data is encrypted at rest (AES-256, keys held in the company's own key-management service) and in transit (TLS 1.3 for every connection, no plaintext fallback).
• Backups are encrypted with the same company-held keys and stay inside the company's account and chosen region.

3.3 Access control

• Every user action is authenticated per session; sign-in is required before any operational surface is shown.
• Role- and ownership-based access: a record's owner, delegation chain and viewers are explicit fields on the record itself, not an afterthought.
• Administrative actions (governance, authority changes, revocations) are restricted to designated owner roles and are individually journaled.

4 · The single owner-approved connection route

The only bridge between the personal and company domains is an explicit routing action taken by the owner inside CRAWLit:

• Nothing synchronises in the background. No message, contact or note crosses into the company domain unless the owner routes that specific item.
• Routing is item-scoped: the owner selects what is shared (for example, one conversation routed to TRACKit as project evidence) — never a bulk mirror of the mailbox.
• Every routing action is recorded on both sides: in the owner's local journal and in the company component's audit trail, with the owner's identity and timestamp.
• Approval can be withdrawn; withdrawal stops any further flow immediately.

5 · Traceability, audit and case durability

• COMMit maintains an append-only chronology per case: commitments, authority, communications, decisions and evidence are journaled and cannot be silently rewritten.
• TRACKit attaches delivery evidence to the work as it moves, so audits read the record instead of reconstructing it.
• Audit entries carry actor, action, subject, timestamp and origin; the governance screen exposes them to designated owners.
• Records are durable by design: they are built to outlive any individual subscription and remain exportable from the company's own account.

6 · No lock-in

• Personal data never left the owner's machine, so there is nothing to repatriate.
• Company data lives in the company's cloud account; ending the relationship with TUTELA does not move, delete or ransom a single record.
• Structured export of actions, projects, funding files and case chronologies is part of the product, not a negotiation.

7 · Operational discipline

• Automated installation: setup is automated end-to-end and asks for input only when a genuine decision is required. Every automated step is visible and reversible.
• Session gating: introductions and sign-in are enforced once per session; no operational surface is reachable without authentication.
• Least surprise: the system never contacts a channel, a cloud, or a third party that the owner or the company has not explicitly connected.

8 · Summary of technical measures