Security and Compliance

How evidence is protected

• Organisation isolation: each organisation sees only its own cases, evidence and records.
• Role-based access: each user sees and does only what their role allows.
• No accounts for submitters: people providing evidence never get platform accounts. They receive a personal upload link for their case and never see reviewer workspaces, findings or decisions.
• Private files: evidence files are never public. Authorised reviewers open them through short-lived links that expire.
• Encryption: all traffic to Truvasse is encrypted in transit with TLS, and data is encrypted at rest by our database and storage provider.
• Bot protection on sign-in and submission forms.

A record that stays defensible

• Every file is fingerprinted with SHA-256 when it arrives, so any later change to it is detectable.
• Forensic findings are append-only and timestamped. A new analysis is a new run, never an edit to an earlier one.
• Requests, files, findings, notes and decisions are kept with who did what and when, ready for an auditor or regulator.

How we build

• Changes to sign-in, permissions, database security and evidence storage go through a separate, version-controlled review path with an independent approval step before release.
• Analytics and third-party scripts are kept off the signed-in platform and evidence upload links.

Deployment options

Truvasse runs as a shared cloud service. Enterprise and public-sector customers can choose a dedicated deployment with their own database, storage and application instance, hosted, where needed, in a region they choose.

Supporting your compliance

Truvasse is built to help regulated organisations meet their own obligations for KYC, onboarding, credentialing, lending and investigations: consistent evidence review, a human decision on every case, and a complete audit trail.

We complete customer security questionnaires, provide a Data Processing Addendum on request, and list the providers we rely on on our Subprocessors page. Independent certifications will be published here once completed.

Report a vulnerability

If you believe you have found a security issue, email hello@truvasse.com with the subject "Security". Please give us reasonable time to fix it before sharing it publicly, and do not access or change other people's data while testing. We will acknowledge good-faith reports and keep you updated.