Trooth

The eight compliance statements of June were rewritten rather than patched. The earlier set described products Trooth does not have, a mobile application it never shipped and a time-stamping scheme it never built, so correcting the names would have left claims with nothing behind them. Each is re-issued as version 2.0, effective today, without a signature, and describes the company that exists: one product, twelve sub-processors, no payment, no health data.

The information security policy set that was available under NDA is now public on the Resources tab, as nineteen numbered policies (POL-01 to POL-19) that take effect as published statements of the company rather than as signed documents. The signed set of 2026-05-25 is superseded. Four assurance statements join them: access monitoring and logging, automated backup and data retention, encryption in transit and at rest, and a network architecture and data flow disclosure.

This page now lists the controls Trooth attests to in six categories, each with the evidence behind it, and names the controls Trooth does not have yet rather than leaving them out. Resources are grouped by topic with their access level shown; the sub-processor tab reads from the published sub-processor list so the two cannot differ; and the page gains subscriptions, a question form and an access request that a person answers within two business days.

A harness that signs in as three real accounts in three workspaces and sends each one foreign and forged identifiers into every covered surface ran green against a production-configured deployment. Its earlier runs found three things, each fixed the same day: a refusal returned in the wrong order, a refusal reported as an outage in a notification email, and a forged identifier answered with a server error instead of a not-found. The harness now insists on the right answer in each case.