Security

Infrastructure Security

• App servers and the PostgreSQL database run on Railway in its EU region (Amsterdam, Netherlands). Railway is a US company.
• Uploaded files are stored in Railway Buckets (Amsterdam), operated by Tigris Data, a US company.
• All public traffic passes through Cloudflare (DNS, reverse proxy, CDN and TLS termination)
• HTTPS enforced on all endpoints

Encryption

• In transit: TLS 1.2 or higher, terminated at Cloudflare
• At rest: the database and file storage are encrypted at rest by our hosting providers

Data Backup & Recovery

• Daily database backups kept by Railway
• We restore the database from those backups when needed

Authentication & Access Control

• Clerk for authentication (SOC2 Type II certified)
• Sign-in is handled by Clerk with short-lived session tokens
• API key authentication for the CLI and MCP server — keys stored as SHA-256 hashes
• Role-based access control (USER / ADMIN)
• Access checks on every item: you can reach only your own documents, documents shared with your team, and marketplace books you subscribe to
• Clerk, our sign-in provider, supports multi-factor authentication (MFA)

Administrative Access & Audit Logging

A small number of Trove staff hold the ADMIN role, which can reach customer records for support and abuse investigation. Every such request is recorded.

• Reads are logged, not just changes. Opening a customer's library, sessions or support tickets writes an audit record, the same as changing them. This covers every admin action in the Trove app: the admin console and admin tools that sign in with an admin API key. Direct database access by staff is outside the app and is not recorded in this log.
• Each record captures who acted, how they authenticated, what resource was touched, which customer it concerned (when the request is about one customer), the source IP, and the timestamp.
• The log is append-only — enforced in the database, not just by convention. The database rejects any attempt to edit, delete or empty (truncate) it, so records cannot be changed or erased through the application.
• Failed privilege checks by signed-in users are recorded too, so a signed-in user who tries to reach admin functionality without authorization is visible in the log.

Data Handling

No model training. We don't train models on your content and we don't use it to train anyone else's. The full scope of this commitment is in our Privacy Policy.

No AI providers in the service. Our servers never send your documents or your agent's questions to any AI model provider, and we never train or fine-tune models on your data.

Staff tools. Our staff use Anthropic's Claude in internal admin tools to review books submitted to the marketplace and to analyse reports of topics libraries could not answer. Staff also use Claude Code for engineering and support work, which can read production data, including account and library records. Staff use Claude on an individual Claude Max plan with the setting that lets Anthropic train on chats turned off. Anthropic's consumer terms apply, which do not include a data processing agreement. We plan to move to Claude Team, which does.

Data Retention

• Research topics expire. The short research topic your agent writes when it reads from your library is erased after 90 days. Reading statistics stay; the topic does not. Book-suggestion reasons are erased after 90 days too. Reports of topics your library could not answer keep their topic text but lose the link to you after 90 days, except reports in a book we are still planning, which stay linked until that work closes.
• Deleting your account removes your documents, covers and attachments, library data, marketplace listings and books you shared with a team. If a file cannot be deleted at that moment, we retry automatically.
• Some records are kept after you delete your account, for example the administrative audit log, since a security log that can be erased by the party it describes is not a security log. Deleted data can also stay in Railway's logs and backups until they expire. The full list is in our Privacy Policy.

Vendor Security

Most of our vendors offer standard data processing terms; we list every vendor and its DPA status on our vendor list. The table below shows the published certifications of our main vendors.

Vendor compliance certifications reflect their published documentation as of our last vendor review (March 2026). *GDPR compliance is self-reported by the vendor and has not been independently verified.

Change Management

• Git-based development workflow with pull requests for code changes
• Production deploys automatically from our release branch after review
• Full git history provides audit trail for all code changes

Incident Response & Breach Notification

As a small team, we do not yet have a formally documented incident response plan. However, in the event of a security incident or data breach, we are committed to:

• Investigating promptly using application and infrastructure logs
• Notifying supervisory authorities within 72 hours as required by GDPR Art. 33
• Notifying affected users without undue delay per GDPR Art. 34
• Notifying affected California residents in the most expedient time possible, as California Civil Code section 1798.82 requires
• Email notification for all material breaches
• Post-incident review and remediation

Documented incident response runbooks and centralized monitoring are planned; see Security Controls below.

Compliance

Trove is designed to align with GDPR (EU) and CCPA (California) requirements.

Our compliance controls include:

• Privacy policy
• Cookie consent mechanism (opt-in)
• Data subject rights handling via email (access, deletion, portability requests)
• Data retention policy
• Vendor transparency

Security Controls

The controls listed below are Trove's own security practices, as distinct from the vendor certifications listed above. They have not been independently audited:

• Access control: Clerk authentication + role-based access (RBAC)
• Encryption: TLS 1.2 or higher in transit; encrypted at rest by our hosting providers
• Logs: Railway infrastructure logs and PostHog error reports
• Audit logging: append-only record of every admin action in the app that reaches customer data, reads included
• Change management: reviewed pull requests and automatic deploys from our release branch

Planned enhancements:

• Formal access reviews
• Annual penetration testing
• Expanded audit logging
• Vendor risk assessments
• Centralized security logging and monitoring
• Documented incident response runbooks
• Employee security awareness training

Responsible Disclosure

We welcome security researchers who discover vulnerabilities in Trove. If you find a security issue, please email security@heytrove.ai.

We commit to:

• Acknowledging reports within 48 hours
• Providing regular status updates on reported issues
• Not pursuing legal action against researchers acting in good faith

Enterprise

For custom security agreements, Data Processing Agreements (DPAs), or compliance questionnaires, contact security@heytrove.ai.