A household's records are among the most private things it owns. This page explains, in plain terms, how Tidemere keeps them: what stays inside, who can see what, how the door is guarded, and what we will never do with them.
Written for principals, estate managers, and the advisors who protect them.
Tidemere operates the software. It does not own, and does not hold a standing key to, any household's records. When a house wants help from us, the house opens the door: support access is granted by the house's own administrator, limited to a set number of hours, and written into the record with the name of the person who granted it. It can be withdrawn at any moment. There is no quiet way in.
Nothing in a household's records is sold, shared, mined, or used to train anything. Not now, and not as a future line of business. The records exist to run the house, and for no other purpose.
If the house ever leaves, it takes everything with it and nothing of its own stays behind.
A well-run house does not announce itself. Neither does the application that runs it. Four things a principal usually asks about, and the plain answer to each.
No third-party services, no trackers, no analytics, no advertising. Even the typefaces are served by Tidemere, so a phone using the app never calls another company.
There is no cookie banner to accept because there is nothing to consent to. The only cookies keep a person signed in and recognize an approved device. This website sets none at all; its privacy policy says so in full.
Every camera in the app is the app's own. A photo taken for a ticket, a receipt, or a checklist goes straight into the record and never touches a personal phone's camera roll.
Staff phones hold no pictures of the house.
Tidemere does not track people. Presence comes from the season plan and the calendar, and on-shift status from the published schedule, never from following a phone.
Hourly staff receive notifications only while on shift at the property, by that property's own clock. Off the clock, everything waits quietly in the Inbox until they return.
The one exception is an emergency notice, which reaches everyone.
Each person sees exactly their share of the house and nothing more. A caregiver's day, a chef's menus, and a housekeeper's rounds are separate rooms, not one shared feed. What the family keeps private reads as a plain coordination label to everyone running the day around it, on every screen, including the phone's own calendar.
Guests meet Tidemere only as the tablet in their room. They never see the machinery, another party's business, or anything about the family. A personal arrangement, one guest's dinner sent to their cabin, appears to them as their own plan, never as an exception someone made.
Messages travel along the chain of command, so an ask lands on the right desk and nowhere else.
Approvals, confirmations, acknowledgements, and changes are recorded by name, at the time of the property where they happened. Records are never revised in place, only versioned, and nothing is ever hard-deleted; things retire to an archive with their history intact.
A document that requires a signature asks again at every revision, so the register always shows who has read the current version, and who has not. When a manager leaves, the house keeps the whole history. It never left.
Two places a record can be exposed: at the sign-in screen, and on the wire between a phone and the house. Both are held.
These are the questions a family office or a security adviser asks before a household signs. The answers here are the ones we give in the room.
Each household runs on its own dedicated instance with its own database. No household shares a record store with another, and no screen in one house can reach another house's records, because there is no path between them.
The demonstration site is a shared demo world built entirely on fictional sample data. It is not a client instance and holds no real household's records.
A household must be able to read its own records: for an audit, for the handover when a manager leaves, for the register of who acknowledged what. End-to-end encryption would put the house's history behind one person's phone, and lose it with that phone.
Encryption in transit, encryption at rest on the house's own instance, and the house holding the keys to that instance is the right shape for a household's records. That is the standard for client hosting.
A client instance runs in a region the household chooses, with nightly backups the house can take with it.
Certification is the last step, not the first, and we have taken the steps in that order on purpose. First the safeguards, each of them built and each of them written into the manuals a house receives. Then the conversation, where every answer goes on paper. Then the outside assessment, which is on our roadmap and will be published here when it is done. We allow no third party into a household's records, and we have taken the same care with what we allow to be said about the system: only what we have built, written down, and can answer for in person.
Speak with the founder before you see a single screen. Ask every question your advisors would ask, and every answer goes in writing. The team that built Tidemere was accountable for a household's systems and vendor access before it ever wrote about them; that story is here.
This page is the security summary. Send it to whoever protects the house.