Security and privacy
Security at Tyllus: private, workspace-scoped import data
Tyllus keeps each importer's shipments, documents, costs and partner details in a private workspace that no other customer can reach. Access is checked on every request against the user's workspace and role, data is encrypted in transit and at rest, partner links expire, backups are managed and redundant, and workspace data is never sold or published.
Updated: October 3, 2026
What data does Tyllus hold for an import team?
Tyllus holds the information an import team needs to run its shipments: accounts and roles, purchase orders and shipments, uploaded documents, partner contacts, costs and customs data, and activity history.
Everything a workspace creates belongs to that workspace. Tyllus never sells workspace data and never publishes it.
| Category | Examples | Where it comes from |
|---|---|---|
| Account and identity | Name, email address, password sign-in or Google sign-in, language, role | Sign-up and profile settings |
| Workspace and membership | Workspace name, members, roles, invitations | Workspace setup and invitations |
| Orders and shipments | Purchase orders, shipment references, container and bill of lading numbers, milestones, ETAs | Your team, documents Tyllus reads, carrier tracking |
| Documents | Proforma and commercial invoices, packing lists, bills of lading, entry summaries, customs documents, freight and broker invoices, photos | Uploads by your team and by partners through expiring links |
| Partner details | Company names, contact names, email addresses, telephone numbers | Your team and partner submissions |
| Costs and customs | Goods, freight, duty, tax and fee amounts, currencies, landed cost | Your team and documents Tyllus reads |
| Activity | Sign-ins, uploads, deletions, partner link activity, timestamps, IP address and browser information | Use of the product |
How is access to a workspace controlled?
Every record, file and action in Tyllus belongs to one workspace. Each request is checked against the signed-in user, the workspace involved and that user's role, so signing in to Tyllus never opens another company's workspace.
Roles decide what each person can do. Sensitive actions, such as changing membership and deleting records or files, are limited to authorised roles.
- Three roles: Owner, Admin and Member. Admins manage workspace settings, invitations, members and partners.
- Invitations go to a named email address and expire after 7 days.
- Workspace separation is checked on every request, not only in the screens you see.
- Tyllus staff access is separate from customer access and is used for support and incident response.
- Automated abuse protection screens requests before they reach workspace data.
How is data encrypted and backed up?
Workspace data and documents are encrypted in transit and at rest. Tyllus runs on managed, redundant backups so the service can be recovered after a failure.
You can take your own copy whenever you need one: download a shipment's documents as one ZIP archive, and export shipments, tracking lists, orders and reports to Excel or CSV.
Which sign-in options does Tyllus support?
Team members sign in with Google or with an email address and password. A password reset uses a time-limited link sent to the registered address.
Passwords are never visible to Tyllus staff and are never shown in the product. Admins decide who belongs to the workspace, and access is checked against current membership on every request.
How do partner and share links stay secure?
Suppliers, freight forwarders and customs brokers never need a Tyllus account. Each one receives a secure link tied to one shipment and one request, and the link stops working when it expires or the request is completed.
Document share links open only the files they were created for and expire after 7 days by default.
- An expired link cannot be used to upload, view or resubmit; the partner can ask for a fresh link.
- Link activity is recorded on the shipment.
- Automatic partner emails can be paused for any shipment.
What happens if there is a security incident?
If Tyllus becomes aware of a security incident affecting data processed through the product, it notifies affected customers as applicable law requires and explains what is known, what is affected and what is being done.
Every event is investigated, contained and recorded according to what it turns out to be.
How long is data kept, and can it be deleted?
Workspace data is kept while the account is active and for as long as it is needed to run the service, meet legal and accounting duties, resolve disputes and maintain records.
After an account is closed, documents and related records may remain for up to ten years where that is reasonably necessary for legal, compliance, accounting, security, backup or dispute purposes.
You can ask for deletion of the data your workspace controls through the contact page. Tyllus confirms in writing what can be deleted, what must be kept and why.
How do I report a vulnerability?
Send security reports to team@tyllus.com with the subject line “Security report”. Include what you found, the steps to reproduce it, the address affected and the date and time of your test.
Tyllus acknowledges each report, investigates it, tells you what was found and what changed, and acts in good faith towards researchers who report privately.
- Do not access, change or delete data that is not yours.
- Do not run automated load or denial-of-service tests against the live service.
- Describe another customer's data instead of including it in your report.
- Give Tyllus time to fix an issue before you publish it.
Can Tyllus support our security and vendor review?
Yes. Tyllus provides a data processing agreement that sets out what it does with customer personal data, on whose instructions, under which security measures and what happens to the data when the contract ends.
Security questionnaires are answered on request. Send your questionnaire or the control areas your review covers through the contact page, and the Tyllus team replies in writing.
Bring your security review to the Tyllus team.
Send your questionnaire or the controls your review covers, and the Tyllus team answers in writing. Please leave passwords and confidential shipment documents out of the contact form.