---
title: "AI Use Policy - Trooth"
description: "How Trooth uses AI, the human oversight it keeps, its training-data stance and how to report misuse."
canonical_url: "https://trooth.co/ai-policy"
markdown_url: "https://trooth.co/ai-policy.md"
generated_from: "the rendered page, converted to Markdown when this was requested"
agent_index: "https://trooth.co/llms.txt"
---

# AI Use Policy

Last Updated October 4, 2026

How Trooth uses AI, its guardrails, and how to raise concerns. It applies to everyone who builds, operates or relies on Trooth.

Questions: [hello@trooth.co](mailto:hello@trooth.co)

## How Trooth uses AI

Trooth-operated AI speeds your work and never makes the final call for you. It appears in two main places:

- **Kyrie**, our assistant, answers questions about your company's record and shows where things are.
- **Questionnaire drafting** proposes security and vendor questionnaire answers from witnessed evidence.

Every AI-assisted output is labeled as AI-generated where you see it, so a draft never passes for a witnessed fact.

## Human oversight

**A person reviews the high-impact outputs of Trooth-operated AI** and decides the wording and what to submit, publish or rely on. Trooth drafts, suggests and organizes; a person can edit or reject any output before it takes effect. Your own agent is different, as Your own AI agent below says.

Trooth signs what it witnessed. It never signs on a company’s behalf. The platform will not certify, approve or attest anything on your behalf.

## Training-data stance

**Trooth does not use your data to train AI models.** Your content, evidence and connected-integration data serve you; they do not train foundation models and are not sold or shared for training.

## Reporting misuse

Report unsafe, harmful or misused AI behavior to [hello@trooth.co](mailto:hello@trooth.co?subject=AI%20Misuse%20Report). We review every report and, where appropriate, adjust the feature or its guardrails.

The [model card](https://trooth.co/model-card) names the models, data access and limitations behind these features.

## Your own AI agent

Two kinds of AI touch a Trust Profile. Trooth-operated AI, Kyrie and questionnaire drafting, is run by Trooth and drafts for a person to decide. A company-authorized agent is your own browser assistant, which Trooth does not run, working in your signed-in session through the profile editor's tools.

Either can change a draft, which only your workspace sees. The published declaration is what buyers and their agents read. Trooth-operated AI never publishes it.

**Delegation authorizes publication without approval of each edit.** While your workspace's publishing permission is on, your own agent may publish your declared fields in an owner's or admin's session, and no person approves each change. The permission is on by default. An owner or admin turns it off in Settings, Workspace; the agent then saves drafts for a person to publish.

Each publish by your agent is attributed to the agent in your workspace's audit log, with the person whose session it used. It never changes what Trooth witnessed, your page address, artwork, the legal-review confirmation or signed model and trust cards.

A refused publish changes nothing. An editor's session, or a workspace with the permission off, gets 403, not permitted. A change that reads as instructions to an AI model, or carries hidden characters, gets 422 and is held for review until a person publishes it from the editor. [Build with AI](https://trooth.co/docs/build-with-ai) lists the tools.

## Revision notes

*Revised October 4, 2026. This policy now separates Trooth-operated AI from a company-authorized browser agent. It says that a company's own agent may publish the company's declared fields without approval of each edit while the workspace's publishing permission is on, which it is by default, and that the person-review rule applies to Trooth-operated AI. No other right or obligation changed.*

## Where your data goes

Every processor Trooth uses, what it is for, what data it receives, where, for how long, who can see it and whether it can train on it. Version 2026-10-12, the same on the Privacy Policy, the Data Processing Agreement, the Sub-processor List and the AI Use Policy, and as [data](https://trooth.co/data-flows.json). Retention periods restate the [Retention Schedule](https://trooth.co/retention), which controls where they differ.

**Transfer safeguard, every row:** For personal data from the EEA, the UK or Switzerland processed in a country without an adequacy decision: the European Commission's Standard Contractual Clauses, with the UK Addendum and Swiss amendments as applicable (DPA section 10).

**Trooth's training commitment, every row:** Trooth does not train AI models on your data, and does not sell or share it so that others can (Privacy Policy section 2).

| Processor | Purpose | Data categories | Region | Retention | Access | Training by the processor |
| --- | --- | --- | --- | --- | --- | --- |
| Cloudflare, Inc. | The account service at api.trooth.co and the network in front of it: edge compute, network security and form bot checks (Turnstile). | Request metadata (IP address, user agent) used to route requests and enforce limits; the account service's records: sign-in, sessions, workspace membership, connector credentials and questionnaire answers a workspace saves. | Global edge | Account service records for the life of the account, removed from live systems within 30 days of closing it, and from its daily export within 35 days after that; rate-limiting counters 7 days (Retention Schedule sections 2 and 3). | Trooth staff with production access; each workspace's records are tenant-isolated (DPA Annex II). | No AI processing in this flow. |
| Cloudflare, Inc. (Workers AI) | AI inference for the Kyrie assistant and for drafting questionnaire answers. A production feature. | A question typed to Kyrie, with passages of Trooth's own public documents; for a questionnaire draft, the question and the workspace's own evidence summaries being phrased. | Global edge | Trooth stores no prompt or output from the inference. A drafted answer is kept only if the workspace saves it, in the account service, for the life of the account. Cloudflare states that Workers AI stores customer content only when a storage service is used alongside it. | The workspace member who asked; Trooth staff with production access. | Cloudflare: Workers AI "does not use your Customer Content to (1) train any AI models made available on Workers AI" (developers.cloudflare.com/workers-ai/platform/privacy, read October 12, 2026). The models are open-weight models Trooth did not train. |
| WorkOS, Inc. | Authentication, single sign-on (SSO) and OAuth. | Name, work email, organization and the identity a single sign-on provider asserts. | United States | For the life of the account; a sign-in session ends when you sign out, when it is revoked, or 30 days after you signed in (Privacy Policy). | The account holder and the workspace's administrators; Trooth staff with production access. | No AI processing in this flow. |
| Neon, Inc. | The managed PostgreSQL database for this website's records. | Company profiles, lists, reviews, sign-offs, buyer and document requests, notification routes, Trust Center access requests and copies of cookie choices. | United States | Per row of the Retention Schedule section 2: working data for the life of the account plus 30 days; derived state 24 months; access records 24 months; cookie receipts 24 months. | The workspace that owns each record; Trooth staff with production access. | No AI processing in this flow. |
| Amazon Web Services, Inc. | The cloud infrastructure beneath the managed database, through Neon. | The same records as the Neon row, at rest. | United States | As the Neon row. Trooth keeps no storage or keys with AWS directly. | Through Neon only. | No AI processing in this flow. |
| GitHub, Inc. | Source control, continuous integration, and storage of the nightly database backup. | The nightly encrypted dump of this website's records. | United States | Each nightly dump is kept 30 days (Retention Schedule section 3). | Trooth staff with repository access. | No AI processing in this flow. |
| Vercel, Inc. | Web hosting, and web analytics where the Cookie Policy allows it. | Request metadata; analytics events only where your cookie choice allows them. | Multi-region edge | Logs are held by the provider under its own retention period, which the Retention Schedule does not cover (section 3). | Trooth staff with production access. | No AI processing in this flow. |
| Sentry (Functional Software, Inc.) | Application error tracking. | Error reports, which can carry request metadata. | United States | Under the provider's own retention period (Retention Schedule section 3). | Trooth staff with production access. | No AI processing in this flow. |
| Resend, Inc. | Transactional email. | Recipient address and the content of the message sent. | United States | Under the provider's own retention period (Retention Schedule section 3). | Trooth staff with production access. | No AI processing in this flow. |
| Google LLC | Business email and document storage. | Correspondence with Trooth and the documents exchanged in it. | Multi-region | Under the provider's own retention period (Retention Schedule section 3). | Trooth staff party to the correspondence. | No AI processing in this flow. |
| Nango | OAuth authorization broker, only when a customer connects an integration. | The OAuth credential for the tool the customer connects. | United States | The credential leaves live systems within 24 hours of disconnecting, and backups within 36 days of disconnecting (Retention Schedule section 2). | The connecting workspace; Trooth staff with production access. | No AI processing in this flow. |
| UptimeRobot | Availability monitoring. | Requests to Trooth's public endpoints. No customer personal data. | Multi-region | Under the provider's own retention period (Retention Schedule section 3). | Trooth staff. | No AI processing in this flow. |
| Anthropic, PBC | Internal-use generative AI for the productivity of Trooth's own staff. Not part of any product feature: no customer-facing feature sends customer data to it. | Only what a Trooth staff member includes in their own work. | United States | Under Anthropic's commercial terms; outside the Retention Schedule. | Trooth staff. | Anthropic's commercial terms: "Anthropic may not train models on Customer Content from Services" (anthropic.com/legal/commercial-terms, read October 12, 2026). |

On this page

1. How Trooth uses AI
2. Human oversight
3. Training-data stance
4. Reporting misuse
5. Your own AI agent
6. Revision notes

## Structured data

```json
{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": "Organization",
      "@id": "https://trooth.co/#org",
      "name": "Trooth",
      "legalName": "Trooth, LLC",
      "alternateName": [
        "Trooth, LLC",
        "Trooth Network",
        "trooth.co"
      ],
      "url": "https://trooth.co",
      "logo": {
        "@type": "ImageObject",
        "@id": "https://trooth.co/#logo",
        "url": "https://trooth.co/brand/trooth-mark_black-on-white_1024.png",
        "contentUrl": "https://trooth.co/brand/trooth-mark_black-on-white_1024.png",
        "width": 1024,
        "height": 1024,
        "caption": "Trooth"
      },
      "image": {
        "@id": "https://trooth.co/#logo"
      },
      "description": "Trooth is an infrastructure and cybersecurity company providing Machine-Readable Trust. The Trooth Network keeps one current Machine-Readable Trust Profile per company, each fact sourced. Trooth signs what it witnessed; company declarations are unsigned.",
      "foundingDate": "2025-12-16",
      "address": {
        "@type": "PostalAddress",
        "streetAddress": "777 Brickell Ave, Suite 500, PMB 1174",
        "addressLocality": "Miami",
        "addressRegion": "FL",
        "postalCode": "33131",
        "addressCountry": "US"
      },
      "contactPoint": {
        "@type": "ContactPoint",
        "contactType": "customer support",
        "email": "hello@trooth.co",
        "url": "https://trooth.co/contact"
      },
      "sameAs": [
        "https://x.com/Troothllc",
        "https://github.com/troothllc",
        "https://www.crunchbase.com/organization/trooth",
        "https://www.wikidata.org/wiki/Q141292994",
        "https://www.youtube.com/@Troothllc",
        "https://www.trustpilot.com/review/trooth.co"
      ]
    },
    {
      "@type": "WebSite",
      "@id": "https://trooth.co/#website",
      "url": "https://trooth.co",
      "name": "Trooth",
      "alternateName": "Trooth Network",
      "inLanguage": "en",
      "publisher": {
        "@id": "https://trooth.co/#org"
      },
      "sameAs": [
        "https://trooth.co/network/company/trooth"
      ],
      "potentialAction": {
        "@type": "SearchAction",
        "target": {
          "@type": "EntryPoint",
          "urlTemplate": "https://trooth.co/network?q={search_term_string}"
        },
        "query-input": "required name=search_term_string"
      }
    },
    {
      "@type": "ItemList",
      "@id": "https://trooth.co/#sitelinks",
      "name": "Trooth sitelinks",
      "itemListElement": [
        {
          "@type": "SiteNavigationElement",
          "position": 1,
          "name": "Join Trooth for free",
          "url": "https://trooth.co/signup"
        },
        {
          "@type": "SiteNavigationElement",
          "position": 2,
          "name": "Company, Trooth",
          "url": "https://trooth.co/network/company/trooth"
        },
        {
          "@type": "SiteNavigationElement",
          "position": 3,
          "name": "Trooth Network",
          "url": "https://trooth.co/network"
        }
      ]
    }
  ]
}
```