Last reviewed: DRAFT — pending legal review; not for publication.

Security Is Part of the Foundation.

Service businesses trust us with information that matters. We build safeguards into the platform’s infrastructure, account access, and day-to-day operations.

Protected access

Trust Systems uses encrypted HTTPS connections, server-managed sessions, and controls designed to help prevent unauthorized requests. Account sessions are protected with secure, HTTP-only cookies and anti-forgery mechanisms where applicable. Account recovery procedures are designed to verify reset requests and invalidate replaced sessions.

Your business stays your business

The platform is organized around separate customer accounts. Server-side authorization and organization membership checks are used to prevent one business’s users from viewing or changing another business’s private information. Permissions are assigned according to account role and active services. Internal privileged access is restricted and recorded.

Changes that can be traced

Important account, profile, access and workflow actions are recorded in audit logs so authorized users and our team can investigate what happened and why. Not all records are public, and audit logs are not represented as an external immutable ledger.

Responsible automation

When optional AI and automation capabilities are enabled, their activity should follow documented permissions and approval workflows. Recommendations should be connected to evidence when possible, and actions that require human approval should not proceed without it. Capabilities not yet enabled must not appear connected or operational.

Operational safeguards

We use layered controls such as input validation, role-aware API checks, rate limiting on sensitive routes, and monitoring. We work to improve our defenses over time. No provider can promise that an internet-connected system is completely secure.

Your part

Use a unique password, do not share logins, review who has access to your organization, and report suspicious activity promptly. Stronger authentication for privileged roles is part of our production-release security requirements and should not be advertised as already enabled until it is live.

Report a security concern

Send security questions or a suspected vulnerability to cmckay@trustsystems.ai, using the subject Security Concern. Please do not send passwords, access tokens or sensitive customer records in ordinary email. We will review good-faith reports. Do not claim a formal bug-bounty program, regulatory certification, 24/7 SOC, or guaranteed response SLA unless approved and true.