---
title: "Resources - Trust Center - Trooth"
description: "Trooth's published security, privacy, AI governance and legal documents, plus those under NDA."
canonical_url: "https://trooth.co/security/resources"
markdown_url: "https://trooth.co/security/resources.md"
generated_from: "the rendered page, converted to Markdown when this was requested"
agent_index: "https://trooth.co/llms.txt"
---

## Resources

[Bulk download](https://trooth.co/trust/Trooth-Trust-Center-Documents.zip)

CompliancePoliciesSecurityAI GovernanceRegulatoryPrivacyLegal

### Compliance

#### Trust and Security Program Summary

Trooth's security, governance, privacy and compliance program at a glance.

#### GDPR Compliance Statement

Trooth's GDPR obligations as processor and controller, article by article.

#### CCPA / CPRA Compliance Statement

Trooth's position under the CCPA as amended, including that it does not sell personal information.

#### NIST Cybersecurity Framework 2.0 Profile

Trooth's profile against the six CSF functions: outcomes met and not yet met.

#### NIST SP 800-171 Self-Assessment

A self-assessment against the 110 requirements: results, method and requirements marked not applicable.

#### Security, Privacy and Compliance Self-Assessment (CAIQ and SIG)

Trooth's completed self-assessment in the two questionnaire formats buyers send most.

#### CISA Secure by Design Pledge

Trooth's signed pledge. CISA publishes the roster; this document is not an entry, and Trooth has not yet confirmed one.

#### Information Security Risk Register

Tracked risks with owners, likelihood, impact, treatment and review dates.

[Request access](https://trooth.co/security/resources?requestAccessOpen=true&requestedResources=risk-register)

#### Information Asset Inventory

Cataloged systems and data assets by classification.

[Request access](https://trooth.co/security/resources?requestAccessOpen=true&requestedResources=asset-inventory)

### Policies

#### POL-01 Information Security Policy

The parent policy: principles, roles, the policy set and how it is kept current.

#### POL-02 Access Control Policy

Who is granted access to what, on what basis, and how it is removed.

#### POL-03 Password and Authentication Policy

Password strength, storage, multi-factor authentication, lockout and session rules.

#### POL-04 Data Classification and Handling Policy

The four classification levels and the handling each one requires.

#### POL-05 Encryption and Key Management Policy

Cryptography in transit and at rest, permitted algorithms, keys and secrets.

#### POL-06 Secure Development and Change Management Policy

The one permitted path to production: gates, review, rollback and emergency change.

#### POL-07 Vulnerability Management Policy

How vulnerabilities are found, given a severity and fixed, with remediation timelines.

#### POL-08 Logging, Monitoring and Access Review Policy

What is logged, how records are protected, alerting, and the access-review schedule.

#### POL-09 Incident Response Policy

Severities, response times, containment, customer notice and the post-mortem.

#### POL-10 Business Continuity and Disaster Recovery Policy

Recovery objectives, failure scenarios and what happens if Trooth's operators are unavailable.

#### POL-11 Backup and Data Retention Policy

Nightly encrypted backups, the restore rehearsal, and the retention schedule with disposal events.

#### POL-12 Asset Management Policy

How systems, data, code, domains, credentials and devices are inventoried and retired.

#### POL-13 Risk Management Policy

How risks are identified, assessed, treated and reviewed, and where the register is kept.

#### POL-14 Vendor and Third-Party Risk Management Policy

Due diligence before a vendor is engaged, the DPA requirement, review and exit.

#### POL-15 Acceptable Use Policy (Personnel)

What people with access may and may not do with Company systems and data.

#### POL-16 Human Resources Security Policy

Screening, agreements, training and offboarding for anyone who acts for the Company.

#### POL-17 Physical and Environmental Security Policy

Physical controls inherited from the providers, and the rules for devices the Company holds.

#### POL-18 Data Residency and Regional Processing Policy

Where data rests and is processed, and how customers are told before either changes.

#### POL-19 AI Governance and Acceptable AI Use Policy

Where AI is used, the decisions a person always makes, and the rules for AI tools.

### Security

#### Security Overview

Authentication, sessions, keys, tenant isolation, the audit ledger, encryption and monitoring.

#### Shared Responsibility Model

Who secures what, between Trooth, its infrastructure providers and the customer.

#### Access Monitoring and Logging Statement

What access and use is recorded, where, how it is protected and who reads it.

#### Automated Backup and Data Retention Statement

Nightly encrypted backups, the monthly restore proof, recovery objectives and the retention schedule.

#### Encryption in Transit and at Rest Assurance Statement

TLS, HSTS and AES-256, permitted algorithms, and checks anyone can run.

#### Network Architecture and Data Flow Disclosure

Components, request path, data flows, trust boundaries and residency region.

#### Vulnerability Disclosure Policy

How to report a vulnerability, the scope, and the safe harbor for good-faith research.

[View (opens in a new tab)](https://trooth.co/security/vulnerability-disclosure-policy)

#### security.txt

Machine-readable contact and policy pointers at the standard well-known location.

[Download](https://trooth.co/.well-known/security.txt)

#### Business Continuity Statement

Recovery objectives, backup cadence, the failure scenarios and the recovery path for each.

[View (opens in a new tab)](https://trooth.co/continuity)

#### Incident Response Runbook

The runbook behind the Incident Response Policy: who does what, in what order, with which accounts.

[Request access](https://trooth.co/security/resources?requestAccessOpen=true&requestedResources=incident-response-plan)

#### Business Continuity and Disaster Recovery Plan

The full plan behind the published statement, including the operator-unavailability runbook.

[Request access](https://trooth.co/security/resources?requestAccessOpen=true&requestedResources=bcp-drp)

### AI Governance

#### AI System Fact Sheet (Model Card)

What Trooth's AI-assisted features do, for whom, their inputs, outputs and limitations.

#### AI Use Policy

Where generative AI is and is not used, decisions a person always makes, and no training on customer content.

[View (opens in a new tab)](https://trooth.co/ai-policy)

#### AI Disclosure

The Network's automated systems and what each does and does not do.

[View (opens in a new tab)](https://trooth.co/ai-disclosure)

#### EU AI Act Transparency and Risk Classification

Trooth's role, each AI feature's risk category, and how each transparency obligation is met.

#### EU AI Act Compliance Statement

Trooth's position under the Regulation as a provider of limited-risk AI features.

#### EU AI Pact Commitments

The commitments Trooth signed with the European Commission ahead of the AI Act's application.

#### NIST AI RMF Alignment Statement

Trooth's AI governance mapped to the framework's four functions, with the gaps named.

### Regulatory

#### REG-01 Data Protection Impact Assessment

The Network's risk assessment: nine risks, measures, residual risk, and three measures not yet in place.

#### REG-02 United States State Privacy Laws Statement

Trooth's position under comprehensive state privacy laws outside California, and the universal answers each asks for.

#### REG-03 Fair Credit Reporting Act Non-Applicability Statement

Why Trooth is not a consumer reporting agency and the Network is not a consumer report, element by element, and the limits that keep it true.

#### REG-04 PIPEDA Compliance Statement (Canada)

Canada's ten PIPEDA principles, and that Canadian data is stored outside Canada, mainly in the United States.

#### REG-05 India Digital Personal Data Protection Act Statement

Trooth's position under India's Digital Personal Data Protection Act, 2023, obligation by obligation.

#### REG-06 Written Information Security Program (FTC Safeguards Rule)

A voluntary written information security program in FTC Safeguards Rule form; the Rule does not reach Trooth.

#### REG-07 23 NYCRR Part 500 Third-Party Service Provider Statement

Section 500.11 answered point by point, for a NYDFS Covered Entity doing its third-party due diligence.

#### REG-08 NIS 2 Directive Supplier Statement

Article 21(2) measures answered as a supplier to an entity in NIS 2 scope; Trooth itself is not in scope.

#### REG-09 HIPAA Non-Applicability and Business Associate Readiness

Why HIPAA does not reach Trooth, its Security Rule position, and its BAA terms.

#### REG-10 EU AI Act Article 53 Non-Applicability and Model Transparency

Why Article 53 model-provider obligations fall on the model providers, not Trooth, and what Trooth can say about the models it calls.

#### REG-11 DORA ICT Third-Party Service Provider Statement

What a financial entity needs for its DORA register, with Article 30 provisions answered one by one.

#### REG-12 APRA CPS 230 Service Provider Statement (Australia)

Materiality under CPS 230, the paragraph 53 provisions answered, and the CPS 234 gaps a regulated entity should weigh.

### Privacy

#### Privacy Policy

What is collected, why, for how long, by whom, and how to exercise your rights.

[View (opens in a new tab)](https://trooth.co/privacy)

#### Data Processing Addendum (DPA)

Processor terms with the standard contractual clauses, incorporated into customer terms without negotiation.

[View (opens in a new tab)](https://trooth.co/dpa)

#### Sub-processor List

Every third party processing customer personal data, with purpose, region and change log.

[View (opens in a new tab)](https://trooth.co/subprocessors)

#### Data Retention Summary

The maximum retention period and the disposal event for each kind of data.

[View (opens in a new tab)](https://trooth.co/retention)

#### Data Subject Rights Request Procedure

How to exercise access, correction, portability and erasure rights, and what happens within 30 days.

#### Cookie Policy

Each cookie the site sets, what it is for and how long it lives.

[View (opens in a new tab)](https://trooth.co/cookies)

#### Records of Processing Activities (RoPA)

GDPR Article 30 records: purposes, categories, recipients and retention.

[Request access](https://trooth.co/security/resources?requestAccessOpen=true&requestedResources=ropa)

#### Data Protection Impact Assessment (DPIA)

The risk assessment for the Network's processing of company and buyer data.

[Request access](https://trooth.co/security/resources?requestAccessOpen=true&requestedResources=dpia)

#### Data Retention and Disposal Schedule

The internal schedule behind the published summary, with disposal methods for each system.

[Request access](https://trooth.co/security/resources?requestAccessOpen=true&requestedResources=retention-schedule)

### Legal

#### Terms of Service

The terms every account accepts.

[View (opens in a new tab)](https://trooth.co/terms)

#### Acceptable Use Policy

What may and may not be done with the product.

[View (opens in a new tab)](https://trooth.co/aup)

#### End User License Agreement

License terms for the software.

[View (opens in a new tab)](https://trooth.co/eula)

#### Service Level Agreement

Availability commitments and the remedy when they are missed.

[View (opens in a new tab)](https://trooth.co/sla)

#### API Terms

Terms for programmatic access, keys and rate limits.

[View (opens in a new tab)](https://trooth.co/api-terms)

#### Accessibility Statement

Trooth's conformance target, what the build tests, and how to report a barrier.

[View (opens in a new tab)](https://trooth.co/accessibility)

Abbreviations used in the Trust Center

**AES**

Advanced Encryption Standard

**AI**

artificial intelligence

**API**

application programming interface

**APRA**

Australian Prudential Regulation Authority

**AWS**

Amazon Web Services

**BAA**

business associate agreement (HIPAA)

**CAIQ**

Consensus Assessments Initiative Questionnaire (Cloud Security Alliance)

**CCPA**

California Consumer Privacy Act

**CISA**

Cybersecurity and Infrastructure Security Agency (United States)

**CPRA**

California Privacy Rights Act

**CSA**

Cloud Security Alliance

**CSF**

Cybersecurity Framework (NIST)

**CPS**

Cross-Industry Prudential Standard (APRA)

**DORA**

Digital Operational Resilience Act (European Union)

**DPA**

data processing agreement

**DPDP**

Digital Personal Data Protection Act (India)

**DPIA**

data protection impact assessment

**DSS**

Data Security Standard (PCI)

**EU**

European Union

**FTC**

Federal Trade Commission (United States)

**GDPR**

General Data Protection Regulation (European Union)

**HIPAA**

Health Insurance Portability and Accountability Act

**HSTS**

HTTP Strict Transport Security

**HTTP**

Hypertext Transfer Protocol

**HTTPS**

HTTP over TLS

**ICT**

information and communication technology

**IEC**

International Electrotechnical Commission

**ISO**

International Organization for Standardization

**LLC**

limited liability company

**NDA**

non-disclosure agreement

**NIS**

Network and Information Security Directive (European Union)

**NIST**

National Institute of Standards and Technology (United States)

**NYCRR**

New York Codes, Rules and Regulations

**NYDFS**

New York State Department of Financial Services

**PBKDF2**

Password-Based Key Derivation Function 2

**PCI**

Payment Card Industry

**PIPEDA**

Personal Information Protection and Electronic Documents Act (Canada)

**RMF**

Risk Management Framework (NIST)

**SHA**

Secure Hash Algorithm

**SIG**

Standardized Information Gathering questionnaire (Shared Assessments)

**SOC**

System and Organization Controls (AICPA)

**SP**

Special Publication (NIST)

**STAR**

Security, Trust, Assurance and Risk registry (Cloud Security Alliance)

**TLS**

Transport Layer Security

**TOTP**

time-based one-time password

**URL**

web address (uniform resource locator)

## Structured data

```json
{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": "Organization",
      "@id": "https://trooth.co/#org",
      "name": "Trooth",
      "legalName": "Trooth, LLC",
      "alternateName": [
        "Trooth, LLC",
        "Trooth Network",
        "trooth.co"
      ],
      "url": "https://trooth.co",
      "logo": {
        "@type": "ImageObject",
        "@id": "https://trooth.co/#logo",
        "url": "https://trooth.co/brand/trooth-mark_black-on-white_1024.png",
        "contentUrl": "https://trooth.co/brand/trooth-mark_black-on-white_1024.png",
        "width": 1024,
        "height": 1024,
        "caption": "Trooth"
      },
      "image": {
        "@id": "https://trooth.co/#logo"
      },
      "description": "Trooth is an infrastructure and cybersecurity company providing Machine-Readable Trust. The Trooth Network keeps one current Machine-Readable Trust Profile per company, each fact sourced. Trooth signs what it witnessed; company declarations are unsigned.",
      "foundingDate": "2025-12-16",
      "address": {
        "@type": "PostalAddress",
        "streetAddress": "777 Brickell Ave, Suite 500, PMB 1174",
        "addressLocality": "Miami",
        "addressRegion": "FL",
        "postalCode": "33131",
        "addressCountry": "US"
      },
      "contactPoint": {
        "@type": "ContactPoint",
        "contactType": "customer support",
        "email": "hello@trooth.co",
        "url": "https://trooth.co/contact"
      },
      "sameAs": [
        "https://x.com/Troothllc",
        "https://github.com/troothllc",
        "https://www.crunchbase.com/organization/trooth",
        "https://www.wikidata.org/wiki/Q141292994",
        "https://www.youtube.com/@Troothllc",
        "https://www.trustpilot.com/review/trooth.co"
      ]
    },
    {
      "@type": "WebSite",
      "@id": "https://trooth.co/#website",
      "url": "https://trooth.co",
      "name": "Trooth",
      "alternateName": "Trooth Network",
      "inLanguage": "en",
      "publisher": {
        "@id": "https://trooth.co/#org"
      },
      "sameAs": [
        "https://trooth.co/network/company/trooth"
      ],
      "potentialAction": {
        "@type": "SearchAction",
        "target": {
          "@type": "EntryPoint",
          "urlTemplate": "https://trooth.co/network?q={search_term_string}"
        },
        "query-input": "required name=search_term_string"
      }
    },
    {
      "@type": "ItemList",
      "@id": "https://trooth.co/#sitelinks",
      "name": "Trooth sitelinks",
      "itemListElement": [
        {
          "@type": "SiteNavigationElement",
          "position": 1,
          "name": "Join Trooth for free",
          "url": "https://trooth.co/signup"
        },
        {
          "@type": "SiteNavigationElement",
          "position": 2,
          "name": "Company, Trooth",
          "url": "https://trooth.co/network/company/trooth"
        },
        {
          "@type": "SiteNavigationElement",
          "position": 3,
          "name": "Trooth Network",
          "url": "https://trooth.co/network"
        }
      ]
    }
  ]
}
```