Trooth

Trooth's security, governance, privacy and compliance program at a glance.

Trooth's GDPR obligations as processor and controller, article by article.

Trooth's position under the CCPA as amended, including that it does not sell personal information.

Trooth's profile against the six CSF functions: outcomes met and not yet met.

A self-assessment against the 110 requirements: results, method and requirements marked not applicable.

Trooth's completed self-assessment in the two questionnaire formats buyers send most.

Trooth's signed pledge. CISA publishes the roster; this document is not an entry, and Trooth has not yet confirmed one.

Tracked risks with owners, likelihood, impact, treatment and review dates.

Cataloged systems and data assets by classification.

The parent policy: principles, roles, the policy set and how it is kept current.

Who is granted access to what, on what basis, and how it is removed.

Password strength, storage, multi-factor authentication, lockout and session rules.

The four classification levels and the handling each one requires.

Cryptography in transit and at rest, permitted algorithms, keys and secrets.

The one permitted path to production: gates, review, rollback and emergency change.

How vulnerabilities are found, given a severity and fixed, with remediation timelines.

What is logged, how records are protected, alerting, and the access-review schedule.

Severities, response times, containment, customer notice and the post-mortem.

Recovery objectives, failure scenarios and what happens if Trooth's operators are unavailable.

Nightly encrypted backups, the restore rehearsal, and the retention schedule with disposal events.

How systems, data, code, domains, credentials and devices are inventoried and retired.

How risks are identified, assessed, treated and reviewed, and where the register is kept.

Due diligence before a vendor is engaged, the DPA requirement, review and exit.

What people with access may and may not do with Company systems and data.

Screening, agreements, training and offboarding for anyone who acts for the Company.

Physical controls inherited from the providers, and the rules for devices the Company holds.

Where data rests and is processed, and how customers are told before either changes.

Where AI is used, the decisions a person always makes, and the rules for AI tools.

Authentication, sessions, keys, tenant isolation, the audit ledger, encryption and monitoring.

Who secures what, between Trooth, its infrastructure providers and the customer.

What access and use is recorded, where, how it is protected and who reads it.

Nightly encrypted backups, the monthly restore proof, recovery objectives and the retention schedule.

TLS, HSTS and AES-256, permitted algorithms, and checks anyone can run.

Components, request path, data flows, trust boundaries and residency region.

How to report a vulnerability, the scope, and the safe harbor for good-faith research.

Machine-readable contact and policy pointers at the standard well-known location.

Recovery objectives, backup cadence, the failure scenarios and the recovery path for each.

The runbook behind the Incident Response Policy: who does what, in what order, with which accounts.

The full plan behind the published statement, including the operator-unavailability runbook.

What Trooth's AI-assisted features do, for whom, their inputs, outputs and limitations.

Where generative AI is and is not used, decisions a person always makes, and no training on customer content.

The Network's automated systems and what each does and does not do.

Trooth's role, each AI feature's risk category, and how each transparency obligation is met.

Trooth's position under the Regulation as a provider of limited-risk AI features.

The commitments Trooth signed with the European Commission ahead of the AI Act's application.

Trooth's AI governance mapped to the framework's four functions, with the gaps named.

The Network's risk assessment: nine risks, measures, residual risk, and three measures not yet in place.

Trooth's position under comprehensive state privacy laws outside California, and the universal answers each asks for.

Why Trooth is not a consumer reporting agency and the Network is not a consumer report, element by element, and the limits that keep it true.

Canada's ten PIPEDA principles, and that Canadian data is stored outside Canada, mainly in the United States.

Trooth's position under India's Digital Personal Data Protection Act, 2023, obligation by obligation.

A voluntary written information security program in FTC Safeguards Rule form; the Rule does not reach Trooth.

Section 500.11 answered point by point, for a NYDFS Covered Entity doing its third-party due diligence.

Article 21(2) measures answered as a supplier to an entity in NIS 2 scope; Trooth itself is not in scope.

Why HIPAA does not reach Trooth, its Security Rule position, and its BAA terms.

Why Article 53 model-provider obligations fall on the model providers, not Trooth, and what Trooth can say about the models it calls.

What a financial entity needs for its DORA register, with Article 30 provisions answered one by one.

Materiality under CPS 230, the paragraph 53 provisions answered, and the CPS 234 gaps a regulated entity should weigh.

What is collected, why, for how long, by whom, and how to exercise your rights.

Processor terms with the standard contractual clauses, incorporated into customer terms without negotiation.

Every third party processing customer personal data, with purpose, region and change log.

The maximum retention period and the disposal event for each kind of data.

How to exercise access, correction, portability and erasure rights, and what happens within 30 days.

Each cookie the site sets, what it is for and how long it lives.

GDPR Article 30 records: purposes, categories, recipients and retention.

The risk assessment for the Network's processing of company and buyer data.

The internal schedule behind the published summary, with disposal methods for each system.

The terms every account accepts.

What may and may not be done with the product.

License terms for the software.

Availability commitments and the remedy when they are missed.

Terms for programmatic access, keys and rate limits.

Trooth's conformance target, what the build tests, and how to report a barrier.