Staff access
Nobody at Trooth can sign in as you.
There is no "log in as", no support session and no way to view your workspace as you. A session exists only because your own password and second factor, your passkey, or your own identity provider sign-in was accepted.
There is no emergency access account.
No master password, no standing credential that opens every workspace, and no emergency token. The operator key that runs maintenance jobs is not an identity and cannot open a workspace.
Staff can stop an account, not enter it.
In an incident Trooth can suspend a person or a workspace. Each suspension is logged with its reason and who made it, and is reversed the same way. A suspended account is refused; nothing in it is read or changed by the suspension.
Recovery ends with your own credential.
If you lose access, the recovery flow sends a link to your address and you set a new password yourself. Every other session ends when it is used. Trooth staff never set or see a password.
A request to act as someone else is refused and logged.
The website and api.trooth.co refuse any request that carries an impersonation or emergency-access header or parameter with 403, before any account is read, and log the attempt.
How this is held
These rules are enforced in the code of the website and of api.trooth.co, and each has a test that fails if a route to impersonate an account, or a credential that opens every workspace, is ever added. Questions go to security@trooth.co. Your own sessions are listed, and can be ended, under security settings.