TraitTune, Inc. - Security Trust Center

Zero-access by design

At TraitTune, the strongest control is architectural: no one — not an employee, not an administrator, not an attacker who breaches our cloud — can read your content or bulk-decrypt our database. End-user content (assessment responses, chat, memory) is encrypted at rest with AES-256-GCM via AWS KMS, and the key policy denies the decrypt permission to every human principal; only the application service role can decrypt, one record at a time, for the logged-in owner. A database exfiltration yields ciphertext.

There is exactly one narrow door: lawful access. When we are legally compelled (e.g., a valid court order), a break-glass procedure decrypts only the specific records named — never the whole dataset — under dual approval with legal-counsel review, via a per-record, time-boxed, single-use key grant, with every step immutably logged. It was drill-tested in July 2026.

On top of that foundation we run row-level data isolation, least-privilege access, a secure development lifecycle, and continuous monitoring. We are transparent about status: our SOC 2 program is in progress (Type I targeted, then Type II) and our controls are aligned with ISO/IEC 27001 — we do not claim certifications we have not yet earned. GDPR and CCPA data-rights (export, deletion with irreversible anonymization, no sale of personal data) are live today. AI features run on enterprise foundation models inside our own AWS environment; user content is never sent to third-party AI vendors and never used to train third-party models. For a security questionnaire or anything not covered here, contact security@traittune.com.

Policies

Internal policies that govern how we operate and protect customer data.

Remote Access & BYOD

Physical Security & Environmental

Acceptable Use & Workstation Security

Data Classification & Handling

Secure Configuration & Hardening

Privacy & Data-Subject Rights

Incident Response & Breach Notification

Risk Management Policy

Controls

Safeguards continuously monitored across our infrastructure and processes.

Acceptable Use

Access Rights

Appropriate-Use & Interpretation Guidance

Architecture Diagram

Asset Inventory

Change management

Configuration management

Configuration & Patch Management

Subprocessors

Third parties that process data on our behalf under strict contractual safeguards.

Amazon Web Services (AWS)

Primary cloud provider: compute, storage, email, DNS, KMS encryption, CDN, and AI inference via AWS Bedrock. Hosts and processes user data.

PostHog

Product analytics and feature flags. Session replay only on public marketing pages, fully masked and consent-gated; assessment/results/chat never recorded.

Sentry

Error and performance monitoring. Error payloads may contain pseudonymous user identifiers; PII scrubbing enabled.

Stripe

Payment processing and subscription billing (merchant-of-record model). TraitTune never stores card data.

Supabase

Managed PostgreSQL database and authentication platform. Stores user accounts and application data with row-level security.

Documents

Reports, DPAs, and security artifacts.

TraitTune-Records-of-Processing-Art30-v1.0.pdf

Records of Processing Activities (GDPR Art. 30) — purposes, legal bases, data categories, recipients/sub-processors, transfers (SCCs), and retention for every processing activity.

NDA

TraitTune-AI-Data-Handling-Addendum-v1.0.pdf

AI Data Handling Addendum to the DPA — no model-training on customer content, data residency, server-side confinement, human-oversight/no-automated-employment-decisions, AI sub-processor terms.

NDA

TraitTune-Data-Protection-Architecture-v1.0.pdf

One-page architecture proof: envelope encryption with a KMS key policy that denies decrypt to all humans (staff, attackers, DB theft all get ciphertext), the court-order-only break-glass path, and AI that runs in our AWS boundary and never trains external models — with a redacted key-policy excerpt.

NDA

TraitTune-Data-Processing-Agreement-v1.0.pdf

Data Processing Agreement (GDPR Art. 28 + SCCs, CCPA Service Provider terms) with TOMs and approved subprocessor annexes. Contact legal@traittune.com to execute.

NDA

FAQ

Quick answers to common security and compliance questions.

Resources

Policies, whitepapers, and contacts for deeper information.

How we collect, use, protect, and delete personal data (GDPR & CCPA).

The master terms governing use of the TraitTune platform.

System Status

Real-time platform availability and incident history.

Do Not Sell or Share My Personal Information

CCPA/CPRA opt-out of sale/sharing of personal information.

TraitTune, Inc. Trust Center

9

23

5