FAQ
On the status page. It shows current availability, incident history with each update as it was posted, and lets you subscribe by email or webhook. Availability is measured from outside Trooth's infrastructure.
At trooth.co/dpa. It incorporates the standard contractual clauses and applies to every customer without negotiation; there is nothing to sign separately.
AI-assisted features draft: a suggested questionnaire answer, a suggested mapping between frameworks, a screening result. They never send, publish, sign, approve or delete anything; a person does that. What Trooth witnessed about a company is a recorded observation with a source and a timestamp, never an AI-generated draft, and is never labeled as one. The AI Use Policy and the AI Disclosure say where AI is and is not used.
No. Trooth does not use customer content, connected-integration data or account information to train foundation models, and does not sell or share it so that others can. Trooth's AI-assisted features run open-weight models on Cloudflare Workers AI, inside the network that serves the product, under terms that exclude inputs and outputs from model training. This is stated in the Privacy Policy.
Trooth does not change the connected system. Connectors observe configuration signals on a schedule and record what they saw. Not every provider offers a read-only grant, so each connector shows the scopes it requests before you connect. The Connector and Read-Only Access Disclosure lists each connector, the scopes it requests and what it reads.
Yes. Neon PostgreSQL on AWS encrypts customer data and backups with AES-256; Trooth's nightly export is AES-256 encrypted before upload.
TLS 1.2 or later everywhere, with HSTS and includeSubDomains: two years on trooth.co, one year on api.trooth.co. trooth.co is not on the browser preload list, a separate, recorded decision.
Customer data is stored in the United States. The website and its edge network run globally. Each sub-processor's processing region is on the sub-processor list.
In encrypted platform configuration and GitHub Actions secrets, never in source. Every build, push to main and pull request checks for committed secrets; a flagged commit does not deploy.
Row-level security on every tenant-data table, which the application's role cannot bypass, and a live harness: three real accounts must be refused foreign and forged identifiers on every covered surface. Every assertion held on a production-configured deployment on 2026-09-17.
Abbreviations used in the Trust Center
- AES
- Advanced Encryption Standard
- AI
- artificial intelligence
- API
- application programming interface
- APRA
- Australian Prudential Regulation Authority
- AWS
- Amazon Web Services
- BAA
- business associate agreement (HIPAA)
- CAIQ
- Consensus Assessments Initiative Questionnaire (Cloud Security Alliance)
- CCPA
- California Consumer Privacy Act
- CISA
- Cybersecurity and Infrastructure Security Agency (United States)
- CPRA
- California Privacy Rights Act
- CSA
- Cloud Security Alliance
- CSF
- Cybersecurity Framework (NIST)
- CPS
- Cross-Industry Prudential Standard (APRA)
- DORA
- Digital Operational Resilience Act (European Union)
- DPA
- data processing agreement
- DPDP
- Digital Personal Data Protection Act (India)
- DPIA
- data protection impact assessment
- DSS
- Data Security Standard (PCI)
- EU
- European Union
- FTC
- Federal Trade Commission (United States)
- GDPR
- General Data Protection Regulation (European Union)
- HIPAA
- Health Insurance Portability and Accountability Act
- HSTS
- HTTP Strict Transport Security
- HTTP
- Hypertext Transfer Protocol
- HTTPS
- HTTP over TLS
- ICT
- information and communication technology
- IEC
- International Electrotechnical Commission
- ISO
- International Organization for Standardization
- LLC
- limited liability company
- NDA
- non-disclosure agreement
- NIS
- Network and Information Security Directive (European Union)
- NIST
- National Institute of Standards and Technology (United States)
- NYCRR
- New York Codes, Rules and Regulations
- NYDFS
- New York State Department of Financial Services
- PBKDF2
- Password-Based Key Derivation Function 2
- PCI
- Payment Card Industry
- PIPEDA
- Personal Information Protection and Electronic Documents Act (Canada)
- RMF
- Risk Management Framework (NIST)
- SHA
- Secure Hash Algorithm
- SIG
- Standardized Information Gathering questionnaire (Shared Assessments)
- SOC
- System and Organization Controls (AICPA)
- SP
- Special Publication (NIST)
- STAR
- Security, Trust, Assurance and Risk registry (Cloud Security Alliance)
- TLS
- Transport Layer Security
- TOTP
- time-based one-time password
- URL
- web address (uniform resource locator)