TrustMetric is built on industry-leading infrastructure with security-first defaults throughout. Here's exactly how we protect your business data.
All data is encrypted in transit using TLS 1.3 and at rest using AES-256. API keys and secrets are stored using industry-standard secret management — never in plaintext.
Production system access is restricted to essential personnel only, protected by multi-factor authentication, and audited on a rolling basis.
TrustMetric runs on Vercel and Supabase — both SOC 2 Type II certified providers. Your data lives in isolated, access-controlled environments.
User authentication is handled by Clerk — a dedicated auth provider with industry-leading security, MFA support, and attack protection built in.
In the event of a security incident, we notify affected users within 72 hours, take immediate containment steps, and publish a post-mortem.
We conduct regular dependency audits, penetration testing, and security reviews. Critical vulnerabilities are patched within 24 hours of discovery.
We don't build security from scratch — we stand on the shoulders of providers who have dedicated security teams and third-party certifications.
Access to customer data is restricted to essential engineering personnel for debugging purposes only, and is logged and audited. We do not read your data for any other purpose.
Your data is stored in Supabase's managed PostgreSQL infrastructure, hosted on AWS in the US East region. Backups are encrypted and retained for 30 days.
Your data is permanently deleted within 30 days of account deletion. Encrypted backups are purged within 90 days. We provide a data export before deletion on request.
We do not store your Google credentials. We use read-only Google Places API access with your Place ID. No OAuth tokens or passwords are retained.
Yes. We support all GDPR rights including access, correction, deletion, and portability. Contact privacy@trustmetric.io to exercise your rights.
Email security@trustmetric.io with details. We take all reports seriously and respond within 24 hours. Responsible disclosure is always appreciated.
We take all security reports seriously. Email us at security@trustmetric.io with a detailed description. We respond within 24 hours and will work with you on responsible disclosure.
Security questions? security@trustmetric.io