Security

How TRUSS protects your company’s data

Written for the person reviewing TRUSS before their company signs. Each point says what the system actually enforces — and where something is not in place yet, we say so.

Leer en español

Each company is kept apart in the database

Every record carries the company it belongs to, and Postgres row-level security decides what each signed-in person can read or write. That is enforced by the database on every query, not by a filter in application code that a bug could skip. An automated test suite runs on every change: it checks that every table has these rules turned on, and it runs cross-company reads and writes against a real Postgres.

Coach conversations are private to the rep

A rep’s conversations with the Coach can be read by that rep and nobody else at their company — not their manager, not the owners, not a holding company’s leaders — and not by TRUSS operators through the operator console. Managers do see practice transcripts and scores, field reviews, visits, meeting plans and outcomes, per-rep activity counts and when each rep was last active. Reps are told where they see each one: the practice screen, the visit card and the meeting plan each say managers can read them. The notes a rep gives for a practice customer stay private to the rep — but the practice customer is played from them, so the conversation managers read may repeat them.

Who at TRUSS can reach your data

TRUSS operators can reach any company’s records to set it up and support it — but not Coach conversations. The console asks for two-step sign-in with an authenticator app before it shows any company’s records, and the database itself refuses operator access to any session that has not completed it: an operator who has not set it up yet reaches no company’s records at all, in the console or outside it. Every console page an operator opens about your company or its people, and every change they make there, appears in your company’s audit log as “TRUSS operations”, with their name. The console’s lists of every company at once — name, plan, seats, billing and invoice status, usage and cost totals — are not logged company by company. Database maintenance access — the engineers who run the database and servers — is separate from the console, and it, like any query made outside the console, is not shown in your audit log.

Changes are on the record

Owners and admins have an audit log of who invited, re-roled or removed whom; who changed settings, the playbook or usage limits; who loaded or deleted company documents and scenarios, assigned drills, reviewed flagged conversations, issued or revoked credentials, exported data, connected a CRM, imported results or removed a customer. Changes made through TRUSS’s database functions — people, roles, settings, credentials and most operator changes — are written in the same transaction as the change itself. The rest are recorded by the server in a separate write, and none goes ahead without its entry: exports, spreadsheet imports of CRM results, deletions of documents and scenarios, a manager’s deletion of someone’s saved brief or campaign, and operator billing actions are recorded before they happen; a new document or scenario is recorded as soon as it exists, and removed again if the record cannot be written. Billing actions get a second entry when Stripe confirms them.

Single sign-on, and removing people

Companies can sign in through their identity provider with SAML single sign-on and require it for their email domain. Then a password sign-in for an address at that domain is refused, and the database returns nothing to a password session for such an address. Removing someone in the identity provider stops their new sign-ins at once, and TRUSS counts an SSO sign-in for 24 hours, so a session they already have stops reaching your company’s data within a day. This also holds if they change their email address. To end access immediately, also remove them in Team → People: that takes effect on their next request, and nothing adds them back — not a domain sign-in, not an old invitation — until someone at the company invites them again.

Holding companies see numbers, not people

A holding company’s leaders see each operating company’s adoption, average scores and outcomes. When fewer than three people practiced in a period, the training numbers are hidden, so a small company’s row cannot point at one person. Leaders have no access to names, transcripts, scorecards or customer records.

Your data leaves when you want it to

Owners and admins can export their company’s data as JSON, and its accounts as CSV, at any time. Every person can download their own data from Settings. Deleting a company removes its data from the live database.

A customer can be forgotten

An owner or admin can delete a customer in one step: the account and everything tied to it — contacts, activity, visits, meeting plans, follow-ups, field reviews, CRM results, the customer’s entries in Coach cards, and reps’ practice notes for rehearsals of the customer’s visits or that give the customer’s full name. A saved visit with no account is removed the same way. Words typed into a Coach message, practice notes that describe the customer without their full name, and practice transcripts are not searched; we delete such a practice session on request. The audit log records the removal and the counts, never the name.

Integration tokens are stored as hashes

A CRM connection authenticates with a token that is shown once and stored only as a SHA-256 hash. It can be revoked instantly, and it can write only to the company that created it.

Recorded conversations need consent, and the audio is not kept with the review

Field reviews require the person uploading to confirm that everyone on the recording knew and agreed. The audio is deleted once the review is saved; the transcript and scorecard are kept, and the confirmation is recorded with them. Audio whose scoring failed and can be retried, or that was uploaded and never submitted, waits in private storage until that person’s next upload clears it out. There is no scheduled clean-up yet, and deleting a person or a company does not reach that storage: ask us and we will delete it.

Company material does not rewrite the safety rules

Documents a company loads are given to the Coach as reference, not instruction, and TRUSS’s safety rules come after them in every prompt. The Coach is built not to coach deductible waiving, exaggerated damage or promised claim outcomes, and the scorer flags them when a rep does. This is how the AI is instructed, not a guarantee — AI can be wrong — which is why flagged conversations go to managers in the compliance report.

Questions reviewers ask

Is our data encrypted?
In transit, yes: every connection to TRUSS, and from TRUSS to its service providers, uses HTTPS (TLS). At rest, yes: our database and file-storage provider, Supabase, encrypts stored data (AES-256).
Do you support two-step sign-in (MFA)?
It is required for TRUSS operators, with an authenticator app: without it the console shows no company’s records and the database gives them no operator access. For your own people, use single sign-on with your identity provider’s MFA. TRUSS does not yet offer two-step sign-in for password accounts.
How long does a session last after we remove someone in our identity provider?
At most 24 hours: TRUSS counts an SSO sign-in for a day, then asks for a new one, and the identity provider refuses someone you removed. Removing the person in Team → People ends their access to your company’s data on their next request. For the session limits set for TRUSS itself, ask us.
Does TRUSS train AI models on our data?
No. TRUSS does not train or fine-tune AI models on customer data. Requests go to OpenAI to be answered; how long OpenAI keeps them is set by its terms for business customers of its API — ask us for the terms that apply.
Where is our data stored?
In Supabase, in the region chosen for the TRUSS project, and handled by the providers listed below. Ask us for the region and for each provider’s processing locations.
Has TRUSS had an independent penetration test?
Ask us for the current status of independent security testing.
How are backups and recovery handled?
Ask us for backup frequency, how long backups are kept, and the most recent restore test.
How quickly will you tell us about a breach?
We will tell affected customers promptly. For a contractual notification window, contact us.
Will you complete our security questionnaire?
Yes — we’ll complete your security questionnaire. Contact us at security@trusscoach.com.
Where do we report a vulnerability?
security@trusscoach.com.

Service providers

Every outside service that receives customer data, and exactly what it receives. Customer names never go to the weather agencies, and they receive only a map point rounded to about 1 km.

Supabase
Used for: Database, sign-in and private file storage. Everything you save in TRUSS lives here. It also sends the sign-in, invitation and password emails.
What it receives: Everything stored in TRUSS, and the email address each sign-in email goes to.
OpenAI
Used for: The AI behind TRUSS: Coach answers, practice customers, scoring, meeting plans, research briefs, campaign drafts, and indexing company documents so the Coach can find them. Also voice: turning speech into text (practice, the Coach, field reviews) and the Coach’s spoken answers.
What it receives: What each request needs: your message and the context the Coach adds to it (company material, the account in view, your upcoming visits), practice audio and transcripts, recordings to turn into text, the text of spoken answers, and the documents a company loads for the Coach — a scanned PDF is sent whole so its pages can be read. Live roleplay audio goes from your device to OpenAI directly.
Google Maps Platform
Used for: Finding addresses on the map, current weather and forecasts, and nearby commercial properties.
What it receives: The address being looked up — a place you search in Research, or an account or visit address — and map coordinates.
US Census Bureau geocoder
Used for: Finding a street address, a city, or a ZIP code on the map, only when this TRUSS server has no Google Maps key.
What it receives: The street address, city and state, or ZIP code being looked up — one typed to the Coach or the Research screen, or an account or visit address — and nothing else from the record.
National Weather Service (NOAA)
Used for: Weather warnings, readings from nearby weather stations, and the forecast when Google Weather is not set up or does not answer.
What it receives: A map point rounded to about 1 km. No names or addresses.
Iowa Environmental Mesonet (Iowa State University)
Used for: Storm reports — hail, wind, tornadoes — near a property, and weather-station history.
What it receives: A map point rounded to about 1 km. No names or addresses.
NOAA Regional Climate Centers (ACIS)
Used for: How this month and season compare with normal.
What it receives: A map point rounded to about 1 km. No names or addresses.
Stripe
Used for: Subscription payments and invoices.
What it receives: Your company’s billing contact, plan and seat count. Card details go to Stripe directly and are never held by us.
Vercel
Used for: Hosting the TRUSS application.
What it receives: Every request to TRUSS passes through it. It keeps ordinary server logs, including IP address and browser type.

Compliance and contracts

TRUSS is preparing for a SOC 2 Type I examination. We do not hold a SOC 2 report today and will not claim one until an independent auditor has issued it.

For contract and data-processing terms, contact us at enterprise@trusscoach.com. Security questions and vulnerability reports go to security@trusscoach.com.

See also the privacy policy.