PLATFORM · SECURITY & PRIVACY
Encryption, access control, and tenant isolation — the technical detail.
A governance platform holds your most sensitive operational data: control gaps, open risks, incident history, supplier weaknesses. The security of the platform itself is therefore not a feature checklist — it is the premise the whole product stands on.
The implementation, in terms a security team can evaluate rather than a marketing team wrote:
| Area | Implementation |
|---|---|
| Encryption in transit | TLS 1.3 enforced on every external endpoint (TLS 1.2 only where a client does not negotiate 1.3) |
| Encryption at rest | AES-256, keys held in an external key-management service, rotation on a documented schedule |
| Tenant isolation | Customer Content logically segregated by tenant identifier at the persistence layer |
| Access control | Role-based access control across the multi-tenant SaaS deployment |
| Logging | Service-event logs with customer-configurable retention in the tenant settings |
| AI processing | Private inference on TruSecure-operated infrastructure by default — no shared public AI service |
Verify, don't trust
The full program is published, versioned and dated on the Trust Center: the Security Statement, the SaaS Data Handling document, the sub-processor list, and the Data Processing Addendum. These are the documents your security and legal teams will ask for in due diligence — they are public because they should be.