Compliance
Effective 26 October 2026
This page explains how Truvasse approaches compliance: the controls the platform provides, the obligations that stay with the customer, and why we do not overclaim certifications.
Our Approach
Truvasse is built to help organizations conduct evidence review with stronger traceability, controlled access, human oversight, and defensible records. Compliance is a shared responsibility: Truvasse provides infrastructure and controls, while customers remain responsible for the legality and fairness of their workflows and decisions.
Frameworks and Laws
Depending on the customer and use case, relevant obligations may include privacy and data-protection laws, financial-services/KYC/AML requirements, employment and consumer-reporting rules, healthcare privacy and security requirements, identity/biometric laws, records-retention duties, anti-discrimination laws, accessibility requirements, and sector-specific regulatory expectations.
No Certification Overclaim
Truvasse does not claim SOC 2, ISO 27001, HIPAA, FedRAMP, PCI DSS, GDPR "certification," CCPA "certification," government approval, or any other certification/authorization unless a current public statement expressly identifies the completed assessment or authorization. Designing controls to support a requirement is not the same as being certified or making a customer compliant.
Human Oversight
Truvasse is not intended to replace authorized human judgment. Forensic and AI-assisted outputs are evidence for review, not automatic fraud verdicts or final consequential decisions.
Customer Diligence
Enterprise customers may request appropriate security, privacy, architecture, subprocessor, DPA, retention, and control information subject to confidentiality and commercial terms.