---
title: "Data Processing Addendum - Trooth"
description: "Data Processing Addendum governing personal data Trooth processes on a customer's behalf."
canonical_url: "https://trooth.co/dpa"
markdown_url: "https://trooth.co/dpa.md"
generated_from: "the rendered page, converted to Markdown when this was requested"
agent_index: "https://trooth.co/llms.txt"
---

# Data Processing Addendum

Last Updated October 12, 2026

Questions: [legal@trooth.co](mailto:legal@trooth.co)

This Data Processing Addendum ("DPA") forms part of the agreement between Trooth, LLC ("Trooth," "Processor") and the customer ("Customer," "Controller") for use of the Service. It applies where Trooth processes personal data on Customer's behalf that is subject to data-protection laws including the GDPR, UK GDPR, and applicable U.S. state privacy laws.

**Contents** 1. Definitions and roles2. Processing of personal data3. Trooth's obligations4. Security5. Sub-processors6. Data-subject requests7. Personal-data breaches8. Deletion and return9. Audits10. International transfersAnnex I - Details of processingAnnex II - Security measuresAnnex III - Sub-processors

## 1. Definitions and roles

Terms such as "controller," "processor," "personal data," "processing," and "data subject" have the meanings in applicable data-protection law. For Customer Data, Customer is the controller (or processor acting for another controller) and Trooth is the processor (or sub-processor). Trooth processes personal data only to provide the Service and on Customer's documented instructions, including as set out in the agreement and this DPA.

## 2. Processing of personal data

The subject matter, duration, nature and purpose of processing, types of personal data, and categories of data subjects are described in Annex I. Customer represents that it has a lawful basis and all necessary rights and notices/consents to provide the personal data and to instruct the processing.

## 3. Trooth's obligations

- Process personal data only on Customer's documented instructions, unless required by law (in which case Trooth will inform Customer unless legally prohibited).
- Ensure persons authorized to process personal data are bound by confidentiality.
- Implement appropriate technical and organizational measures (Annex II).
- Assist Customer, taking into account the nature of processing, in responding to data-subject requests and in meeting security, breach-notification, and impact-assessment obligations.
- Not sell personal data or process it for any purpose other than providing the Service.

## 4. Security

Trooth maintains the security measures described in Annex II, designed to protect personal data against unauthorized or unlawful processing and against accidental loss, destruction, or damage.

## 5. Sub-processors

Customer authorizes Trooth to engage the sub-processors listed in Annex III and others added in the ordinary course. Trooth will impose data-protection obligations on each sub-processor substantially similar to those in this DPA and remains responsible for their performance. Trooth will give Customer a means to learn of new sub-processors and a reasonable opportunity to object on reasonable data-protection grounds.

## 6. Data-subject requests

Taking into account the nature of the processing, Trooth will assist Customer by appropriate measures to fulfill Customer's obligation to respond to requests to exercise data-subject rights. If Trooth receives such a request directly, it will, where lawful, direct the data subject to Customer.

## 7. Personal-data breaches

Trooth will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal-data breach affecting Customer's personal data and will provide information reasonably available to assist Customer in meeting its notification obligations.

## 8. Deletion and return

**8.1 Timelines.** The periods below restate the Retention Schedule at [trooth.co/retention](https://trooth.co/retention), effective October 4, 2026, which controls where the two differ. A period runs from Customer's action, and every period ends with the data gone from backups as well as live systems.

| Data | On termination, or on the action named | Removed from live systems | Gone from backups |
| --- | --- | --- | --- |
| Working data held by the website: lists, watchlists, reviews, sign-offs, document requests, notification routes | Termination (closing the account) | Within 30 days | Within 30 days after that, so at most 60 days |
| Account service records: sign-in, sessions, workspace membership, connector credentials | Termination | Within 30 days | Within 35 days after that, so at most 65 days |
| Connected-integration credentials | Disconnecting the integration | Within 24 hours | Within 35 days after that, so at most 36 days |
| A published profile | Unpublishing, or termination | Within 30 days; the public page stops at once | Within 30 days after that, so at most 60 days |
| One item Customer deletes | Deleting it | Immediately | Within 35 days |

**8.2 Return and export format.** Before termination, and until working data leaves live systems, Customer can download its data as one JSON file from Settings (GET /api/account/export): the account service's records and the records the website keeps for the account. A part that could not be read is named in the file rather than omitted. At Customer's written request to privacy@trooth.co Trooth provides the same file within 10 business days.

**8.3 Disposal.** Data is disposed of by deletion from live systems and by the automatic expiry of the encrypted backups that hold it. Backups are not edited; they expire on the schedule in 8.1. Before the website uses a database restored from a backup, the restore reapplies every account erasure made since that backup was taken. The account service has no such replay for its own export, so an item deleted after an export was taken can return with a restore of it until deleted again, and still expires within the backup period.

**8.4 Exceptions.** Kept for a fixed period whatever is deleted, because their purpose is to be a record: security and authentication logs for 12 months, and records of who opened a document Customer shared for 24 months. The records in section 4 of the Retention Schedule (copies of cookie choices, correction history, dispute files, opt-out records, corporate records) end on that schedule. Error reports, transactional email records and application logs are held by the sub-processors in Annex III under their own retention periods. Retention required by law prevails.

**8.5 Confirmation.** At Customer's written request, Trooth confirms in writing, within 10 business days after the last period in 8.1 has passed, that the deletion is complete, naming any record kept under 8.4 and why.

## 9. Audits

**9.1 What Trooth provides.** Trooth will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer. Trooth does not hold an independent certification or a third-party audit report today; its control statements are self-attested and are listed with their status at [trooth.co/security/controls](https://trooth.co/security/controls).

**9.2 Cadence.** Customer may audit once in any 12-month period, and additionally after a personal-data breach affecting Customer's personal data or when a supervisory authority requires it.

**9.3 Notice.** Customer gives at least 30 days' written notice to privacy@trooth.co naming the scope, the auditor and the proposed dates; 5 business days are enough after a breach or at a supervisory authority's request. An auditor that is not Customer signs a confidentiality undertaking first.

**9.4 Remote first.** Trooth answers an audit first with documentation, written answers and a remote review of evidence, including a screen-shared walkthrough. An on-site inspection takes place where a remote review cannot reasonably establish compliance with this DPA, or where a supervisory authority requires it, during business hours and without access to other customers' data.

**9.5 Cost.** Each party bears its own costs. For an on-site inspection beyond one in a 12-month period, Customer reimburses Trooth's reasonable, documented costs, except after a breach or where the audit finds a material failure to comply with this DPA.

**9.6 Retention cross-reference.** The periods this DPA cites are those of the Retention Schedule effective October 4, 2026 and the data-flow matrix version 2026-10-12 shown with this document and at /data-flows.json. A later version that shortens a period applies at once; one that lengthens a period applies only after 30 days' written notice to Customer.

## 10. International transfers

Where Trooth transfers personal data originating in the EEA, UK, or Switzerland to a country without an adequacy decision, the parties incorporate the European Commission's Standard Contractual Clauses (and the UK Addendum / Swiss amendments as applicable), which are deemed completed with the information in the Annexes.

## Annex I - Details of processing

- **Controller:** Customer. **Processor:** Trooth, LLC.
- **Subject matter:** provision of the Trooth trust and compliance Service.
- **Duration:** the term of the agreement plus any legally required retention.
- **Nature and purpose:** collecting, recording, organizing, storing, analyzing, and displaying observed evidence and related records to provide the Service.
- **Types of personal data:** business contact details (name, work email, company), account identifiers, usage/log data, and any personal data contained in connected-system signals or uploaded content that Customer chooses to process.
- **Categories of data subjects:** Customer's authorized users and personnel, and individuals whose data appears in connected systems or uploaded content.

## Annex II - Security measures

- Encryption in transit (TLS) and encryption of sensitive stored fields and credentials at rest (AES-256-GCM).
- Least-privilege access controls and authenticated, tenant-isolated access to data.
- Edge isolation and segregation of customer data by tenant.
- Logging, monitoring, and integrity measures, including tamper-evident records.
- Regular backups with retention, and restricted administrative access.
- Secure software-development and change-management practices.

## Annex III - Sub-processors

| Sub-processor | Purpose | Location |
| --- | --- | --- |
| Cloudflare, Inc. | Network, security, form bot checks and AI inference | Global edge |
| WorkOS, Inc. | Sign-in and single sign-on (SSO) | United States |
| Amazon Web Services, Inc. | Cloud infrastructure beneath the database (through Neon) | United States |
| Anthropic, PBC | Internal productivity tools | United States |
| Google LLC | Business email and documents | Multi-region |
| Neon, Inc. | Managed database | United States |
| Nango (only when a customer connects an integration via OAuth) | Authorization for integrations a customer connects | United States |
| Vercel, Inc. | Web hosting, and analytics where the Cookie Policy allows | Multi-region edge |
| Sentry (Functional Software, Inc.) | Error tracking | United States |
| Resend, Inc. | Transactional email | United States |
| UptimeRobot | Availability monitoring | Multi-region |
| GitHub, Inc. | Source control, continuous integration and encrypted backups | United States |

© 2026 Trooth, LLC, Miami, Florida, USA. All rights reserved. Contact: [privacy@trooth.co](mailto:privacy@trooth.co)

*Revised September 4, 2026: Stripe, Inc. removed from Annex III. Trooth takes no payment and processes no card data, so no payment processor handles personal data on a customer's behalf. No other sub-processor, obligation or safeguard was changed.*

*Revised September 4, 2026: Expo (650 Industries, Inc.) removed from Annex III. Trooth distributes no mobile application and sends no push notifications, so no such processing occurs.*

*Revised October 6, 2026: two Annex III rows corrected to match the Sub-processor List. Amazon Web Services is the cloud beneath the managed database (through Neon, in the United States), not storage and key management in the United States and European Union. Cloudflare's purpose names the form bot check (Turnstile) and the AI inference (Workers AI) behind the Kyrie assistant, which the Sub-processor List has stated since September 27, 2026. No sub-processor was added, and no right, obligation or safeguard was changed.*

*Revised October 12, 2026: sections 8 and 9 now state measurable terms. Section 8 gives the deletion period for each kind of data, to live systems and to backups, the export format, how data is disposed of, the exceptions and a written confirmation on request; the periods restate the Retention Schedule. Section 9 gives the audit cadence, notice, a remote-first review, cost allocation and the retention cross-reference, and says Trooth holds no independent certification today. No period was lengthened and no right of Customer was narrowed.*

*Revision note. Revised October 17, 2026. The sub-processor rows here now read as the Sub-processor List does after its October 17 revision: each purpose in a few words, without internal systems, database engines, cloud regions or backup schedules. No sub-processor was added or removed, no data moved, and no right or obligation was narrowed; the change is recorded under our [publication and correction policy](https://trooth.co/corrections).*

*Revision note. Revised October 21, 2026. Section 7 now states the 72-hour outer limit for notifying Customer of a personal-data breach that the Security page and the security controls page have stated as this agreement's commitment. The obligation was tightened, not narrowed, and the change is recorded under our [publication and correction policy](https://trooth.co/corrections).*

*Revision note. Revised October 23, 2026. Annex III is now written from the Sub-processor List row for row: each sub-processor's purpose and location read exactly as the list states them, in the same order. Before this revision the annex described the same twelve sub-processors in older wording (for example "USA" where the list says "United States"). No sub-processor was added or removed, no data moved, and no right or obligation was narrowed; the change is recorded under our [publication and correction policy](https://trooth.co/corrections).*

Adopted for and on behalf of Trooth, LLC.

## Where your data goes

Every processor Trooth uses, what it is for, what data it receives, where, for how long, who can see it and whether it can train on it. Version 2026-10-12, the same on the Privacy Policy, the Data Processing Agreement, the Sub-processor List and the AI Use Policy, and as [data](https://trooth.co/data-flows.json). Retention periods restate the [Retention Schedule](https://trooth.co/retention), which controls where they differ.

**Transfer safeguard, every row:** For personal data from the EEA, the UK or Switzerland processed in a country without an adequacy decision: the European Commission's Standard Contractual Clauses, with the UK Addendum and Swiss amendments as applicable (DPA section 10).

**Trooth's training commitment, every row:** Trooth does not train AI models on your data, and does not sell or share it so that others can (Privacy Policy section 2).

| Processor | Purpose | Data categories | Region | Retention | Access | Training by the processor |
| --- | --- | --- | --- | --- | --- | --- |
| Cloudflare, Inc. | The account service at api.trooth.co and the network in front of it: edge compute, network security and form bot checks (Turnstile). | Request metadata (IP address, user agent) used to route requests and enforce limits; the account service's records: sign-in, sessions, workspace membership, connector credentials and questionnaire answers a workspace saves. | Global edge | Account service records for the life of the account, removed from live systems within 30 days of closing it, and from its daily export within 35 days after that; rate-limiting counters 7 days (Retention Schedule sections 2 and 3). | Trooth staff with production access; each workspace's records are tenant-isolated (DPA Annex II). | No AI processing in this flow. |
| Cloudflare, Inc. (Workers AI) | AI inference for the Kyrie assistant and for drafting questionnaire answers. A production feature. | A question typed to Kyrie, with passages of Trooth's own public documents; for a questionnaire draft, the question and the workspace's own evidence summaries being phrased. | Global edge | Trooth stores no prompt or output from the inference. A drafted answer is kept only if the workspace saves it, in the account service, for the life of the account. Cloudflare states that Workers AI stores customer content only when a storage service is used alongside it. | The workspace member who asked; Trooth staff with production access. | Cloudflare: Workers AI "does not use your Customer Content to (1) train any AI models made available on Workers AI" (developers.cloudflare.com/workers-ai/platform/privacy, read October 12, 2026). The models are open-weight models Trooth did not train. |
| WorkOS, Inc. | Authentication, single sign-on (SSO) and OAuth. | Name, work email, organization and the identity a single sign-on provider asserts. | United States | For the life of the account; a sign-in session ends when you sign out, when it is revoked, or 30 days after you signed in (Privacy Policy). | The account holder and the workspace's administrators; Trooth staff with production access. | No AI processing in this flow. |
| Neon, Inc. | The managed PostgreSQL database for this website's records. | Company profiles, lists, reviews, sign-offs, buyer and document requests, notification routes, Trust Center access requests and copies of cookie choices. | United States | Per row of the Retention Schedule section 2: working data for the life of the account plus 30 days; derived state 24 months; access records 24 months; cookie receipts 24 months. | The workspace that owns each record; Trooth staff with production access. | No AI processing in this flow. |
| Amazon Web Services, Inc. | The cloud infrastructure beneath the managed database, through Neon. | The same records as the Neon row, at rest. | United States | As the Neon row. Trooth keeps no storage or keys with AWS directly. | Through Neon only. | No AI processing in this flow. |
| GitHub, Inc. | Source control, continuous integration, and storage of the nightly database backup. | The nightly encrypted dump of this website's records. | United States | Each nightly dump is kept 30 days (Retention Schedule section 3). | Trooth staff with repository access. | No AI processing in this flow. |
| Vercel, Inc. | Web hosting, and web analytics where the Cookie Policy allows it. | Request metadata; analytics events only where your cookie choice allows them. | Multi-region edge | Logs are held by the provider under its own retention period, which the Retention Schedule does not cover (section 3). | Trooth staff with production access. | No AI processing in this flow. |
| Sentry (Functional Software, Inc.) | Application error tracking. | Error reports, which can carry request metadata. | United States | Under the provider's own retention period (Retention Schedule section 3). | Trooth staff with production access. | No AI processing in this flow. |
| Resend, Inc. | Transactional email. | Recipient address and the content of the message sent. | United States | Under the provider's own retention period (Retention Schedule section 3). | Trooth staff with production access. | No AI processing in this flow. |
| Google LLC | Business email and document storage. | Correspondence with Trooth and the documents exchanged in it. | Multi-region | Under the provider's own retention period (Retention Schedule section 3). | Trooth staff party to the correspondence. | No AI processing in this flow. |
| Nango | OAuth authorization broker, only when a customer connects an integration. | The OAuth credential for the tool the customer connects. | United States | The credential leaves live systems within 24 hours of disconnecting, and backups within 36 days of disconnecting (Retention Schedule section 2). | The connecting workspace; Trooth staff with production access. | No AI processing in this flow. |
| UptimeRobot | Availability monitoring. | Requests to Trooth's public endpoints. No customer personal data. | Multi-region | Under the provider's own retention period (Retention Schedule section 3). | Trooth staff. | No AI processing in this flow. |
| Anthropic, PBC | Internal-use generative AI for the productivity of Trooth's own staff. Not part of any product feature: no customer-facing feature sends customer data to it. | Only what a Trooth staff member includes in their own work. | United States | Under Anthropic's commercial terms; outside the Retention Schedule. | Trooth staff. | Anthropic's commercial terms: "Anthropic may not train models on Customer Content from Services" (anthropic.com/legal/commercial-terms, read October 12, 2026). |

On this page

1. 1. Definitions and roles
2. 2. Processing of personal data
3. 3. Trooth's obligations
4. 4. Security
5. 5. Sub-processors
6. 6. Data-subject requests
7. 7. Personal-data breaches
8. 8. Deletion and return
9. 9. Audits
10. 10. International transfers
11. Annex I - Details of processing
12. Annex II - Security measures
13. Annex III - Sub-processors

## Structured data

```json
{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": "Organization",
      "@id": "https://trooth.co/#org",
      "name": "Trooth",
      "legalName": "Trooth, LLC",
      "alternateName": [
        "Trooth, LLC",
        "Trooth Network",
        "trooth.co"
      ],
      "url": "https://trooth.co",
      "logo": {
        "@type": "ImageObject",
        "@id": "https://trooth.co/#logo",
        "url": "https://trooth.co/brand/trooth-mark_black-on-white_1024.png",
        "contentUrl": "https://trooth.co/brand/trooth-mark_black-on-white_1024.png",
        "width": 1024,
        "height": 1024,
        "caption": "Trooth"
      },
      "image": {
        "@id": "https://trooth.co/#logo"
      },
      "description": "Trooth is an infrastructure and cybersecurity company providing Machine-Readable Trust. The Trooth Network keeps one current Machine-Readable Trust Profile per company, each fact sourced. Trooth signs what it witnessed; company declarations are unsigned.",
      "foundingDate": "2025-12-16",
      "address": {
        "@type": "PostalAddress",
        "streetAddress": "777 Brickell Ave, Suite 500, PMB 1174",
        "addressLocality": "Miami",
        "addressRegion": "FL",
        "postalCode": "33131",
        "addressCountry": "US"
      },
      "contactPoint": {
        "@type": "ContactPoint",
        "contactType": "customer support",
        "email": "hello@trooth.co",
        "url": "https://trooth.co/contact"
      },
      "sameAs": [
        "https://x.com/Troothllc",
        "https://github.com/troothllc",
        "https://www.crunchbase.com/organization/trooth",
        "https://www.wikidata.org/wiki/Q141292994",
        "https://www.youtube.com/@Troothllc",
        "https://www.trustpilot.com/review/trooth.co"
      ]
    },
    {
      "@type": "WebSite",
      "@id": "https://trooth.co/#website",
      "url": "https://trooth.co",
      "name": "Trooth",
      "alternateName": "Trooth Network",
      "inLanguage": "en",
      "publisher": {
        "@id": "https://trooth.co/#org"
      },
      "sameAs": [
        "https://trooth.co/network/company/trooth"
      ],
      "potentialAction": {
        "@type": "SearchAction",
        "target": {
          "@type": "EntryPoint",
          "urlTemplate": "https://trooth.co/network?q={search_term_string}"
        },
        "query-input": "required name=search_term_string"
      }
    },
    {
      "@type": "ItemList",
      "@id": "https://trooth.co/#sitelinks",
      "name": "Trooth sitelinks",
      "itemListElement": [
        {
          "@type": "SiteNavigationElement",
          "position": 1,
          "name": "Join Trooth for free",
          "url": "https://trooth.co/signup"
        },
        {
          "@type": "SiteNavigationElement",
          "position": 2,
          "name": "Company, Trooth",
          "url": "https://trooth.co/network/company/trooth"
        },
        {
          "@type": "SiteNavigationElement",
          "position": 3,
          "name": "Trooth Network",
          "url": "https://trooth.co/network"
        }
      ]
    }
  ]
}
```