# Security

> Encryption, European hosting, tenant isolation, sub-processors and responsible disclosure.

Source: https://trinta.ai/security · Format: Markdown mirror of that page · Language: en

## Encryption and transport

- All traffic is served over HTTPS with TLS, and the domain is on the HSTS preload list, so browsers refuse any insecure connection to trinta.ai.
- Data is encrypted in transit end to end, and at rest by our hosting and database providers.

## Hosting and data residency

- TRINTA runs on European infrastructure: application compute and the Postgres database are both hosted in London, United Kingdom (Vercel and Neon, on AWS eu-west-2). Your data does not leave Europe in normal operation.
- The UK is covered by the European Commission's adequacy decision, so GDPR-grade protections apply end to end. We are built GDPR-first; the Privacy Policy has the full detail on what we collect and why.

## Your workspace is private

- Every client runs in a private, branded workspace. Your keyword profile, your scored tenders, your pipeline and your notes are visible only to your team.
- Access is owner-scoped and checked on every request: one client can never read another client's data, even by guessing a URL.
- We never sell, rent or share your company profile or your tender pipeline. Public tender notices are public by nature; everything we learn about your business stays yours.

## Access and authentication

- Sessions use signed, HttpOnly, Secure, SameSite cookies. Login is rate-limited per account and per IP, with bot protection, to stop brute-force and credential spraying.
- Administrative and internal endpoints are gated behind separate keys and fail closed if a key is missing.

## Application hardening

- A strict Content Security Policy (no unsafe-eval), X-Frame-Options DENY and frame-ancestors none (no clickjacking), nosniff, a locked-down Permissions-Policy and a strict Referrer-Policy ship on every response.
- Any URL you submit (for example in the instant match) is fetched through an SSRF guard that blocks private, loopback and cloud-metadata addresses and caps the response size.
- All inbound API payloads are schema-validated, size-capped and rate-limited.

## Sub-processors

- Hosting and database: Vercel and Neon (London, UK). AI processing: Anthropic and OpenAI, used to read a website and score tenders, never to train shared models on your data. Transactional email: Resend.
- Product analytics run in aggregate only. The full, current list lives in the Privacy Policy.

## For your legal and procurement team

- A data processing agreement (DPA) is available for every engagement, and we complete security questionnaires as part of any evaluation. Email lucas@trinta.ai and we respond within one business day.
- Contracts are annual, invoiced with bank transfer and purchase order support. No card details ever touch our systems.

## Responsible disclosure

- Found something? Email lucas@trinta.ai and we will respond quickly. We do not pursue good-faith researchers who report privately and give us time to fix.

---

Full site index for agents: https://trinta.ai/llms.txt · Whole site in one document: https://trinta.ai/llms-full.txt