Data Return & Portability

Your data is yours.

Trooth offers three different downloads, and they are not substitutes for one another:

• A public record, as JSON from /api/network/profile or as Markdown: what anyone can read about a published company. Anyone can download it; it is not signed.
• A signed sign-off, from the buyer workspace: one buyer's recorded decision about one vendor, signed so it can be checked without Trooth. It is not a copy of an account.
• Your account export, described below: every record Trooth keeps for your account, in one JSON file you can read with any JSON tool and without Trooth. It is not signed.

You can download a copy of your account record at any time from your dashboard (Settings → Account → Download my data). That file has two parts. The first comes from the account service: your company account, its most recent profile views and account events, your consents and your disputes. The API returns this first part on its own (GET /me/export). The second part, under site, is only in the dashboard download. It holds the records this website keeps for your account, one list for each kind of record:

• your Trust Profile, as a draft and as published, and your Trust Center settings;
• your teams and their invitations, including teams you were added to;
• access requests and document requests sent to your company, and the visits counted on your Trust Profile;
• your published updates, lists and link checks;
• your domain claims, the actions you took for a domain, and your replies to events reported about your company;
• endorsements about your company, endorsements you wrote, and the attestation requests you sent;
• your connector settings and publishing permissions, and your control mapping and comparison reviews;
• quotes you issued or received;
• your buyer lists, watchlist and its alerts, reviews, sign-offs, projects, document requests and their access log, feed and share links;
• invitations to join Trooth that you sent or received;
• your notification routes and their delivery records, and your subscriptions to the Trooth status page and Trust Center;
• the terms you accepted, the agents you connected with their tool calls and delegated tasks, and the keys that stop a repeated request from acting twice;
• your setup progress and the state of your email summaries and alerts.

Some values are left out on purpose, and the file lists each one with the reason. Secret values are left out: link and feed tokens, one-time codes, the value that proves a domain claim, stored copies of API responses, and the part of a webhook address after its host. So is personal data about other people that you did not enter yourself, such as the sign-in address of someone who wrote an endorsement about your company, of the vendor staff who sent you a quote, or of the owner of a team you joined, and a visitor's network address and browser. If part of these records cannot be read when you download, the file says so and names what is missing. A list longer than 50,000 rows is cut at 50,000, and the file names it. Three kinds of record are not in the file: disputes filed on this site, your email opt-outs, and long-running agent jobs. Ask privacy@trooth.co for them and they are sent to you within 30 days, the window for any data subject request.

Deleting your account removes it at once and cannot be undone, so download your data first. Working account and profile records are removed within 30 days of your request, and no backup copy is kept longer than 35 days: the website's nightly database dump is deleted at 30 days and the API's daily export at 35. The Data Retention Summary lists each kind of data with its retention period.

If Trooth ever winds down the Services, we commit to giving reasonable advance notice and a means to export your data before any deletion. You can leave at any time and take your data with you.

We do not sell your data, and we never use it to train AI models, ours or a third party's.

Questions: privacy@trooth.co.