FAQ
On the status page. It shows current availability, incident history with each update as it was posted, and lets you subscribe by email or webhook. Availability is measured from outside Trooth's infrastructure.
At trooth.co/dpa. It incorporates the standard contractual clauses and applies to every customer without negotiation; there is nothing to sign separately.
AI-assisted features draft: a suggested questionnaire answer, a suggested mapping between frameworks, a screening result. They never send, publish, sign, approve or delete anything; a person does that. What Trooth witnessed about a company is a recorded observation with a source and a timestamp, never an AI-generated draft, and is never labelled as one. The AI Use Policy and the AI Disclosure say where AI is and is not used.
No. Trooth does not use customer content, connected-integration data or account information to train foundation models, and does not sell or share it so that others can. Trooth's AI-assisted features run open-weight models on Cloudflare Workers AI, inside the network that serves the product, under terms that exclude inputs and outputs from model training. This is stated in the Privacy Policy.
Read-only. Connectors observe configuration signals on a schedule and record what they saw; they do not modify the connected system. The Connector and Read-Only Access Disclosure lists each connector, the scopes it requests and what it reads.
Yes. Customer data lives in a managed PostgreSQL database on AWS that encrypts volumes and backups at rest with AES-256, and Trooth's own nightly export is encrypted with AES-256 before it leaves the runner that made it.
Every connection uses TLS 1.2 or later. Strict Transport Security is sent on every response with a two-year max-age, includeSubDomains and preload, so a browser that has seen trooth.co once will not attempt plain HTTP again.
Primary customer data is stored in the United States, in AWS us-east-1 through Neon. The web application is served from Vercel with its primary region in the eastern United States, and edge compute and content delivery run globally through Cloudflare. Each sub-processor's processing region is on the sub-processor list.
Credentials are held in the hosting platforms' encrypted environment configuration and never in source. A secret scan runs in the build on every commit and a second scanner runs on every push; a commit that contains a credential does not deploy.
Two ways, both tested. In the database, every table holding tenant data has row-level security with a policy, and the application connects as a role that cannot bypass it. Above the database, a harness signs in as three real accounts and sends each one foreign and forged identifiers into every covered surface, asserting a refusal each time; it ran green against a production-configured deployment on 2026-09-17.