Security

The website

• Every page is served over HTTPS.
• The site is static HTML. It has no login, takes no payments, and sets no tracking cookies.
• Internal documents, database code and tests are kept out of the published site.

Partnership enquiries

• Enquiries go to a server function that checks every field, accepts only our own web addresses, rejects automated submissions and limits how often one source can send.
• They are stored in the EU in a table the public cannot read, with database row-level security switched on. Only authorised Truo staff can review them.
• No secret keys are sent to your browser.

The platform and its agents

The Truo Trade platform is in private beta. Access is scoped by role, so each participant in a trade sees only what their part needs. Agents work inside the same permissions as the person or workspace they act for, and consequential steps wait for a named person to approve them. See how Truo agents are governed.

We do not claim certifications such as ISO 27001 or SOC 2. If your organisation needs a security questionnaire answered for the beta, ask us.

Report a vulnerability

If you think you have found a security problem, contact the Truo team and ask for a secure channel to send the details and steps to reproduce it. Please give us reasonable time to fix it before telling anyone else, do not access or change other people's data, and do not run tests that degrade the service. We will acknowledge your report within five working days and will not take legal action against good-faith research that follows these rules.