--- title: "Updates - Trust Center - Trooth" description: "Dated changes to Trooth's Trust Center: documents, controls, sub-processors and the page itself." canonical_url: "https://trooth.co/security/updates" markdown_url: "https://trooth.co/security/updates.md" generated_from: "the rendered page, converted to Markdown when this was requested" agent_index: "https://trooth.co/llms.txt" --- ## Updates ### The change-control description is corrected to what the deploy workflow enforces Security Published September 23, 2026 The control for production deploys said that direct deploys from a laptop were refused by the workflow's own checks. The workflow has no such check, so the sentence was withdrawn. The control now says what holds: the routine path is the GitHub Actions workflow, which does not upload until every build gate succeeds; the gates are also part of the build command, so a build made with the project's configuration runs them; and nothing refuses a deploy made outside GitHub by someone holding the hosting account's deploy token, so access to production rests on who holds that token. ### The compliance statements are rewritten, twelve regulatory statements are published, and the compliance list says what each record is Compliance Published September 18, 2026 The eight compliance statements of June were rewritten rather than patched. The earlier set described products Trooth does not have, a mobile application it never shipped and a time-stamping scheme it never built, so correcting the names would have left claims with nothing behind them. Each is re-issued as version 2.0, effective today, without a signature, and describes the company that exists: one product, twelve sub-processors, no payment, no health data. ### The policy set is published: nineteen policies and four assurance statements, no signature required Compliance Published September 18, 2026 The information security policy set that was available under NDA is now public on the Resources tab, as nineteen numbered policies (POL-01 to POL-19) that take effect as published statements of the company rather than as signed documents. The signed set of May 25, 2026 is superseded. Four assurance statements join them: access monitoring and logging, automated backup and data retention, encryption in transit and at rest, and a network architecture and data flow disclosure. ### The Trust Center is reorganized around controls, resources and evidence General Published September 18, 2026 This page now lists the controls Trooth states it has in place, in six categories, each with the evidence behind it, and names the controls Trooth does not have yet rather than leaving them out. Resources are grouped by topic with their access level shown; the sub-processor tab reads from the published sub-processor list so the two cannot differ; and the page gains subscriptions, a question form and an access request that a person answers within two business days. ### Tenant isolation tested against a live deployment with real sessions Security Published September 17, 2026 A harness that signs in as three real accounts in three workspaces and sends each one foreign and forged identifiers into every covered surface ran with every assertion met against a production-configured deployment. Its earlier runs found three things, each fixed the same day: a refusal returned in the wrong order, a refusal reported as an outage in a notification email, and a forged identifier answered with a server error instead of a not-found. The harness now insists on the right answer in each case. ### EU AI Pact listing confirmed on the Commission's roster Compliance Published September 17, 2026 The European Commission's public roster of AI Pact signatories lists Trooth. The listing is a fact a third party publishes in a register Trooth does not control, which is the standard this page holds itself to before it shows a registration. ### First restore rehearsal completed Security Published September 10, 2026 A workflow restored a nightly encrypted backup into a fresh database and checked that the tables and row counts came back. It completed successfully and is scheduled to run monthly from now on. ### Sub-processor list: Stripe and Expo removed Sub-processors Published September 4, 2026 Stripe was removed because Trooth takes no payment and processes no card data. Expo was removed because Trooth distributes no mobile application. Neither removal changes any processing of customer personal data. Abbreviations used in the Trust Center **AES** Advanced Encryption Standard **AI** artificial intelligence **API** application programming interface **APRA** Australian Prudential Regulation Authority **AWS** Amazon Web Services **BAA** business associate agreement (HIPAA) **CAIQ** Consensus Assessments Initiative Questionnaire (Cloud Security Alliance) **CCPA** California Consumer Privacy Act **CISA** Cybersecurity and Infrastructure Security Agency (United States) **CPRA** California Privacy Rights Act **CSA** Cloud Security Alliance **CSF** Cybersecurity Framework (NIST) **CPS** Cross-Industry Prudential Standard (APRA) **DORA** Digital Operational Resilience Act (European Union) **DPA** data processing agreement **DPDP** Digital Personal Data Protection Act (India) **DPIA** data protection impact assessment **DSS** Data Security Standard (PCI) **EU** European Union **FTC** Federal Trade Commission (United States) **GDPR** General Data Protection Regulation (European Union) **HIPAA** Health Insurance Portability and Accountability Act **HSTS** HTTP Strict Transport Security **HTTP** Hypertext Transfer Protocol **HTTPS** HTTP over TLS **ICT** information and communication technology **IEC** International Electrotechnical Commission **ISO** International Organization for Standardization **LLC** limited liability company **NDA** non-disclosure agreement **NIS** Network and Information Security Directive (European Union) **NIST** National Institute of Standards and Technology (United States) **NYCRR** New York Codes, Rules and Regulations **NYDFS** New York State Department of Financial Services **PBKDF2** Password-Based Key Derivation Function 2 **PCI** Payment Card Industry **PIPEDA** Personal Information Protection and Electronic Documents Act (Canada) **RMF** Risk Management Framework (NIST) **SHA** Secure Hash Algorithm **SIG** Standardized Information Gathering questionnaire (Shared Assessments) **SOC** System and Organization Controls (AICPA) **SP** Special Publication (NIST) **STAR** Security, Trust, Assurance and Risk registry (Cloud Security Alliance) **TLS** Transport Layer Security **TOTP** time-based one-time password **URL** web address (uniform resource locator) ## Structured data ```json { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://trooth.co/#org", "name": "Trooth", "legalName": "Trooth, LLC", "alternateName": [ "Trooth, LLC", "Trooth Network", "trooth.co" ], "url": "https://trooth.co", "logo": { "@type": "ImageObject", "@id": "https://trooth.co/#logo", "url": "https://trooth.co/brand/trooth-mark_black-on-white_1024.png", "contentUrl": "https://trooth.co/brand/trooth-mark_black-on-white_1024.png", "width": 1024, "height": 1024, "caption": "Trooth" }, "image": { "@id": "https://trooth.co/#logo" }, "description": "Trooth is an infrastructure and cybersecurity company providing Machine-Readable Trust. The Trooth Network keeps one current Machine-Readable Trust Profile per company, each fact sourced. Trooth signs what it witnessed; company declarations are unsigned.", "foundingDate": "2025-12-16", "address": { "@type": "PostalAddress", "streetAddress": "777 Brickell Ave, Suite 500, PMB 1174", "addressLocality": "Miami", "addressRegion": "FL", "postalCode": "33131", "addressCountry": "US" }, "contactPoint": { "@type": "ContactPoint", "contactType": "customer support", "email": "hello@trooth.co", "url": "https://trooth.co/contact" }, "sameAs": [ "https://x.com/Troothllc", "https://github.com/troothllc", "https://www.crunchbase.com/organization/trooth", "https://www.wikidata.org/wiki/Q141292994", "https://www.youtube.com/@Troothllc", "https://www.trustpilot.com/review/trooth.co" ] }, { "@type": "WebSite", "@id": "https://trooth.co/#website", "url": "https://trooth.co", "name": "Trooth", "alternateName": "Trooth Network", "inLanguage": "en", "publisher": { "@id": "https://trooth.co/#org" }, "sameAs": [ "https://trooth.co/network/company/trooth" ], "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://trooth.co/network?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "ItemList", "@id": "https://trooth.co/#sitelinks", "name": "Trooth sitelinks", "itemListElement": [ { "@type": "SiteNavigationElement", "position": 1, "name": "Join Trooth for free", "url": "https://trooth.co/signup" }, { "@type": "SiteNavigationElement", "position": 2, "name": "Company, Trooth", "url": "https://trooth.co/network/company/trooth" }, { "@type": "SiteNavigationElement", "position": 3, "name": "Trooth Network", "url": "https://trooth.co/network" } ] } ] } ```