# Trust kit

> **Pre-launch draft.** Written from the code and the deployment. The server has run on AWS (ECS Fargate behind
> CloudFront, us-east-1) since 2026-11-03, before public launch.

What Telltale does, in one line: it tells a customer's application whether a signed-in session is being driven by a
person or by an AI agent (a browser agent such as Claude in Chrome, or other automation), with how it knows. It
**detects AI agents, not several people sharing one login**: two colleagues using one account look like people to
Telltale, and Telltale doesn't try to tell them apart.

| Page | What it answers |
|---|---|
| [Data location and retention](/docs/data-retention) | Where data lives and how long each kind is kept |
| [Redaction controls](/docs/redaction) | What is never collected, and the controls you have on top of that |
| [SOC 2 plan](/docs/soc2) | Controls already in place, the gaps, and the timeline to a Type I and Type II report |
| [Script size and page impact](/docs/sdk-performance) | The SDK's compressed size and main-thread cost, measured, with the method |

**Available on request:** the data processing agreement, the privacy policy, the terms of service, the security
overview and the subprocessor list. They are being reviewed by a lawyer before they are published. Email
jad@heypharos.com and we will send them.

## Report a security issue

Email jad@heypharos.com with "Security" in the subject: what you found, where, and how to reproduce it. Please don't
test against other customers' data or degrade the service while you look. We read every report, reply to say we have
it, and tell you when it is fixed. The same address is in [security.txt](/.well-known/security.txt) (RFC 9116).