Our Approach to Security
Your data security is our top priority. Learn about our security practices and data protection measures.
Data Encryption
All data is encrypted in transit using TLS. Data at rest is encrypted by our cloud infrastructure provider. All database connections use secure encrypted channels.
Infrastructure Security
Hosted on enterprise-grade cloud infrastructure with high availability. Database backups are performed automatically by our infrastructure provider.
Access Controls
Role-based access control (RBAC) with owner, admin, member, and tester roles. Multi-factor authentication (MFA) via authenticator apps. SSO trust configuration for workspace guest access.
Audit Logging
Activity tracking for test case changes, test run updates, and user actions. Audit logs capture who changed what and when for traceability.
GDPR Readiness
We implement data protection practices aligned with GDPR principles. Our platform includes the following features to support your compliance needs:
- Privacy Policy: Documented user rights including right of access and right to erasure
- Data Export: Export your data at any time (GDPR Article 15, Right of Access)
- Account Deletion: Request account deletion with a grace period (GDPR Article 17, Right to Erasure)
- Cookie Policy: Detailed disclosure of tracking technologies used
- Data Retention: Defined data retention periods, with secure deletion
Security Practices
- Responsible Disclosure: If you discover a security vulnerability, report it to security@trulit.com
- Access Controls: Role-based permissions with multi-factor authentication
- Data Isolation: Row-level security ensuring users only access data within their projects
Data Protection
- Data Isolation: Row-level security policies ensure complete project-level data separation
- Backup & Recovery: Automated database backups provided by our cloud infrastructure
- Data Retention: Defined data retention periods, with secure deletion
- Data Portability: Export your data at any time in standard formats
Handling Sensitive Data
Trulit is built for organizations with strict data-handling requirements. Our platform includes the following safeguards:
- Access Controls: Role-based access control (RBAC) with project-level permissions. Multi-factor authentication is supported and can be required per organization
- Audit Logging: Append-only logging of access changes, membership, invitations, licensing and authentication events
- Session Management: Access tokens expire after one hour, with refresh-token rotation and reuse detection
- Encryption: Data encrypted in transit and at rest by our cloud infrastructure
- Data Isolation: Row-level security policies ensuring project-level data separation
Note: Trulit does not currently offer HIPAA Business Associate Agreements. If you need to store or process protected health information, contact compliance@trulit.com before doing so. See our position on BAAs.
Report a Vulnerability
If you discover a security vulnerability, please report it responsibly to security@trulit.com. We appreciate your help in keeping our platform secure.
Contact Security Team
For security inquiries, contact security@trulit.com