Trooth

The control for production deploys said that direct deploys from a laptop were refused by the workflow's own checks. The workflow has no such check, so the sentence was withdrawn. The control now says what holds: the routine path is the GitHub Actions workflow, which does not upload until every build gate succeeds; the gates are also part of the build command, so a build made with the project's configuration runs them; and nothing refuses a deploy made outside GitHub by someone holding the hosting account's deploy token, so access to production rests on who holds that token.

The eight compliance statements of June were rewritten rather than patched. The earlier set described products Trooth does not have, a mobile application it never shipped and a time-stamping scheme it never built, so correcting the names would have left claims with nothing behind them. Each is re-issued as version 2.0, effective today, without a signature, and describes the company that exists: one product, twelve sub-processors, no payment, no health data.

The information security policy set that was available under NDA is now public on the Resources tab, as nineteen numbered policies (POL-01 to POL-19) that take effect as published statements of the company rather than as signed documents. The signed set of May 25, 2026 is superseded. Four assurance statements join them: access monitoring and logging, automated backup and data retention, encryption in transit and at rest, and a network architecture and data flow disclosure.

This page now lists the controls Trooth states it has in place, in six categories, each with the evidence behind it, and names the controls Trooth does not have yet rather than leaving them out. Resources are grouped by topic with their access level shown; the sub-processor tab reads from the published sub-processor list so the two cannot differ; and the page gains subscriptions, a question form and an access request that a person answers within two business days.

A harness that signs in as three real accounts in three workspaces and sends each one foreign and forged identifiers into every covered surface ran with every assertion met against a production-configured deployment. Its earlier runs found three things, each fixed the same day: a refusal returned in the wrong order, a refusal reported as an outage in a notification email, and a forged identifier answered with a server error instead of a not-found. The harness now insists on the right answer in each case.

The European Commission's public roster of AI Pact signatories lists Trooth. The listing is a fact a third party publishes in a register Trooth does not control, which is the standard this page holds itself to before it shows a registration.

A workflow restored a nightly encrypted backup into a fresh database and checked that the tables and row counts came back. It completed successfully and is scheduled to run monthly from now on.

Stripe was removed because Trooth takes no payment and processes no card data. Expo was removed because Trooth distributes no mobile application. Neither removal changes any processing of customer personal data.