Trooth

Trooth's security, governance, privacy and compliance program at a glance, written for a buyer's first read.

How Trooth meets its obligations as a processor and a controller under the General Data Protection Regulation, article by article.

Trooth's position under the California Consumer Privacy Act as amended, including the statement that personal information is not sold.

Trooth's current profile against the six CSF functions, with the outcomes it meets and the ones it does not yet.

A self-assessment against the 110 requirements, with the score, the method and the requirements marked not applicable.

Trooth's completed self-assessment in the two questionnaire formats buyers most often send.

Trooth's signed pledge statement. CISA publishes the signatory roster; the roster entry is confirmed separately from this document.

Tracked risks with owners, likelihood, impact, treatment and review dates.

Catalogued systems and data assets by classification.

The parent policy: principles, roles, the policy set and how it is kept current.

Who is granted access to what, on what basis, and how it is removed.

Password strength, storage, multi-factor authentication, lockout and session rules.

The four classification levels and the handling each one requires.

Cryptography in transit and at rest, permitted algorithms, keys and secrets.

One path to production: the gates every change passes, review, rollback and emergency change.

How vulnerabilities are found, scored and fixed, with the remediation timelines.

What is logged, how records are protected, alerting, and the access-review schedule.

Severities, response times, containment, customer notice and the post-mortem.

Recovery objectives, failure scenarios and what happens if the founder is unavailable.

Nightly encrypted backups, the restore rehearsal, and the retention schedule with disposal events.

How systems, data, code, domains, credentials and devices are inventoried and retired.

How risks are identified, scored, treated and reviewed, and where the register lives.

Due diligence before a vendor is engaged, the DPA requirement, review and exit.

What every person with access may and may not do with Company systems and data.

Screening, agreements, training and offboarding for anyone who acts for the Company.

Physical controls inherited from the providers, and the rules for devices the Company holds.

Where data rests, where it is processed, and how customers are told before either changes.

Where AI is used in the product and the business, the decisions a person always makes, and the rules for AI tools.

How Trooth protects customer data: authentication, sessions, keys, tenant isolation, the audit ledger, encryption and monitoring.

Who secures what, between Trooth, its infrastructure providers and the customer.

What is recorded about access and use, where it is held, how it is protected and who reads it.

Nightly encrypted backups, the monthly restore proof, recovery objectives and the retention schedule.

TLS, HSTS and AES-256 in transit and at rest, the permitted algorithms, and the checks anyone can run.

The components, the path of a request, every data flow, the trust boundaries and the residency region.

How to report a vulnerability, what is in scope, and the safe harbor for good-faith research.

The machine-readable contact and policy pointers at the standard well-known location.

Recovery objectives, backup cadence, the failure scenarios and the recovery path for each.

The operational runbook behind the published Incident Response Policy: who does what, in what order, with which accounts.

The full plan behind the published statement, including the founder-unavailability runbook.

What Trooth's AI-assisted features do, for whom, with what inputs and outputs, and their limitations.

Where generative AI is and is not used in the product, which decisions a person always makes, and the commitment not to train on customer content.

The automated systems that observe, organise and protect the Network, and what each one does and does not do.

Trooth's role, the risk category of each AI-assisted feature, and how each transparency obligation is met.

Trooth's position under the Regulation as a provider of limited-risk AI features.

The commitments Trooth signed with the European Commission ahead of the AI Act's application.

Trooth's AI governance activities mapped to the four functions of the framework, with the gaps named.

The risk assessment for the Network's processing: nine risks, the measures against each, the residual, and the three measures not yet in place.

Trooth's position under the comprehensive privacy laws of the states other than California, and the universal answers every one of them asks for.

Why Trooth is not a consumer reporting agency and the Network is not a consumer report, element by element, and the limits that keep it true.

The ten fair information principles of Canada's PIPEDA, and a plain statement that Canadian data is stored in the United States.

Trooth's position under India's Digital Personal Data Protection Act, 2023, obligation by obligation.

A written information security program in the form the FTC Safeguards Rule prescribes, adopted voluntarily; the Rule does not reach Trooth.

Section 500.11 answered point by point, for a NYDFS Covered Entity doing its third-party due diligence.

The Article 21(2) measures answered as a supplier, for an entity in scope of NIS 2. Trooth is not in scope itself.

Why HIPAA does not reach Trooth, where it would already stand against the Security Rule, and on what terms it would sign a BAA.

Why the Article 53 obligations of a general-purpose AI model provider fall on the model providers and not on Trooth, and what Trooth can tell a buyer about the models it calls.

What a financial entity needs for its DORA register of information, and the Article 30 provisions answered one by one.

Materiality under CPS 230, the paragraph 53 provisions answered, and the CPS 234 gaps a regulated entity should weigh.

What is collected, why, for how long, who processes it, and how to exercise your rights.

Processor terms with the standard contractual clauses, incorporated into customer terms without negotiation.

Every third party that processes customer personal data, with its purpose and processing region, and the change log.

The maximum retention period and the disposal event for each kind of data.

How to exercise access, correction, portability and erasure rights, and what happens within the 30 days.

Each cookie the site sets, what it is for and how long it lives.

GDPR Article 30 records: purposes, categories, recipients and retention.

Risk assessment for the processing the Network performs on company and buyer data.

The internal schedule behind the published summary, with disposal methods per system.

The terms every account accepts.

What may and may not be done with the product.

License terms for the software.

Availability commitments and the remedy when they are not met.

Terms for programmatic access, keys and rate limits.

Trooth's conformance target, what is tested in the build, and how to report a barrier.