TraitTune, Inc. - Security Trust Center

Security & privacy, by design

TraitTune, Inc. builds a privacy-preserving layer between people and AI, so the data we hold is among the most sensitive a company can process — and we protect it accordingly. End-user content is encrypted at rest with AES-256-GCM under AWS KMS key policies that deny decryption to every human principal; only the application can read it. Every user table is isolated with row-level security, all traffic is TLS-encrypted, and our email domain enforces DMARC p=reject.

We are transparent about status: our SOC 2 program is in progress (Type I targeted, then Type II) and our controls are aligned with ISO/IEC 27001 — we do not claim certifications we have not yet earned. Our GDPR and CCPA data-rights machinery (export, deletion with irreversible anonymization, no sale of personal data) is live today. AI features run on enterprise foundation models inside our own AWS environment; user content is never sent to third-party AI vendors and never used to train third-party models.

This Trust Center gives your procurement and security teams what they need in one place: our current framework status, published policies, subprocessor list, a Security & Privacy Whitepaper, and a ready-to-execute Data Processing Agreement. For a security questionnaire or anything not covered here, contact security@traittune.com.

23

Policies

Internal policies that govern how we operate and protect customer data.

Remote Access & BYOD

Physical Security & Environmental

Acceptable Use & Workstation Security

Data Classification & Handling

Secure Configuration & Hardening

Privacy & Data-Subject Rights

Incident Response & Breach Notification

Risk Management Policy

37

Controls

Safeguards continuously monitored across our infrastructure and processes.

Acceptable Use

Access Rights

Architecture Diagram

Asset Inventory

Change management

Configuration management

Configuration & Patch Management

Credential Management

5

Subprocessors

Third parties that process data on our behalf under strict contractual safeguards.

Amazon Web Services (AWS)

Primary cloud provider: compute, storage, email, DNS, KMS encryption, CDN, and AI inference via AWS Bedrock. Hosts and processes user data.

PostHog

Product analytics and feature flags. Session replay only on public marketing pages, fully masked and consent-gated; assessment/results/chat never recorded.

Sentry

Error and performance monitoring. Error payloads may contain pseudonymous user identifiers; PII scrubbing enabled.

Stripe

Payment processing and subscription billing (merchant-of-record model). TraitTune never stores card data.

Supabase

Managed PostgreSQL database and authentication platform. Stores user accounts and application data with row-level security.

2

Documents

Reports, DPAs, and security artifacts.

TraitTune-Data-Processing-Agreement-v1.0.pdf

Data Processing Agreement (GDPR Art. 28 + SCCs, CCPA Service Provider terms) with TOMs and approved subprocessor annexes. Contact legal@traittune.com to execute.

NDA

TraitTune-Security-and-Privacy-Whitepaper-v1.0.pdf

Security & Privacy Whitepaper (v1.0) — encryption, access control, SDLC, hosting, incident response, privacy, AI, subprocessors, and compliance status.

NDA

12

FAQ

Quick answers to common security and compliance questions.

Resources

Policies, whitepapers, and contacts for deeper information.

Privacy Policy

How we collect, use, protect, and delete personal data (GDPR & CCPA).

Terms of Service

The master terms governing use of the TraitTune platform.

System Status

Real-time platform availability and incident history.

Do Not Sell or Share My Personal Information

CCPA/CPRA opt-out of sale/sharing of personal information.

TraitTune, Inc. Trust Center

5

23

5