TRUVAD / SECURITY & TRUST

Security & Trust.

How Truvad protects your data — starting from one principle: with SENTINEL, your regulated content never leaves your server.

Security is the product. Our core design principle: your data never leaves your server. SENTINEL runs air-gapped inside your own environment, and GRIP is built to the controls U.S. financial-services teams expect.

Data residency

SENTINEL processes your documents on-premise. No regulated content is sent to Truvad.

Encryption

TLS in transit and encryption at rest across GRIP's hosted services.

Access control

Role-based access, least privilege, and MFA on administrative access.

Isolation

Tenant data is logically separated; on-prem deployments are fully isolated.

1. Our model: data stays on your side

Truvad ships two products with deliberately different trust boundaries. SENTINEL is delivered as an air-gapped, on-premise package: it runs inside your network, processes your documents locally, and requires no outbound internet connection. Your regulated content is never transmitted to, stored by, or accessible to Truvad. GRIP is our hosted intelligence layer; it ingests public regulatory sources and stores only the account and configuration data needed to run your feed.

2. Encryption

In transit: all traffic to GRIP is encrypted with TLS.
At rest: hosted data is encrypted using industry-standard algorithms.
Secrets: credentials and keys are stored in a managed secrets store, never in source code.

3. Access control & authentication

Role-based access control with least-privilege defaults.
Multi-factor authentication on administrative and production access.
Support for SSO is available on enterprise plans.

4. Infrastructure & network

GRIP runs on hardened, reputable cloud infrastructure with network segmentation, firewalling, and continuous patching. SENTINEL inherits your own network controls and can be deployed with no egress.

5. Secure development

Peer code review on changes to production systems.
Automated dependency and vulnerability scanning in CI.
Separation of development, staging, and production environments.

6. Monitoring & incident response

We log and monitor access to production systems and maintain an incident-response process. In the event of a security incident affecting your data, we will notify affected customers in line with applicable law and contractual commitments.

7. Compliance & certifications

Truvad's controls are aligned to the expectations of regulated financial-services buyers. Our current status:

SOC 2 Type IIIn progress — observation period underway; report available under NDA once complete.
GDPR & CCPA/CPRAAligned — see our Privacy Policy.
Data Processing Addendum (DPA)Available — on request for enterprise customers.

Certification status is updated here as it progresses. For the current SOC 2 report, sub-processor list, or a security questionnaire, contact [email protected].

8. Data handling & retention

We collect the minimum data needed to run the Services and retain it only as long as necessary. Details are in our Privacy Policy.

9. Vulnerability disclosure

We welcome responsible disclosure. If you believe you have found a security issue, email [email protected] with details and steps to reproduce. Please do not publicly disclose until we have had a reasonable opportunity to remediate.

10. Contact

Security team — [email protected]. For enterprise due diligence, we can provide a security questionnaire response, DPA, and architecture overview.