Security Overview

Infrastructure

Compute	Cloudflare Workers — V8 isolates, no persistent server processes
Storage	Cloudflare D1 (SQLite-backed), Vectorize, R2; Customer region-selected
State	Durable Objects per conversation (SQLite-backed, single-region)
LLM	Anthropic API (Claude Haiku 4.5 + Sonnet 4.6)
Edge cache	Cloudflare KV for tenant-key lookup (60 s TTL)

Access control

Tenant API keys are stored as SHA-256 hashes; plaintext is shown once at provisioning.
Admin endpoints (/v1/admin/*, /v1/pipeline/*) are gated by a deployment-wide internal secret stored in Cloudflare's secret store, not in source code.
No cross-tenant queries are reachable from the chat API — multi-tenant isolation enforced at D1 row and Vectorize metadata levels.
Truvyo employees with production access use Cloudflare SSO with hardware-backed MFA.

Data protection

All traffic over TLS 1.2+. HTTP is rejected at the edge.
Data at rest is encrypted by Cloudflare (AES-256).
Customer Content is processed only to serve that Customer's tenant.
No bulk export endpoint exists — eliminates a class of credential-leak exfiltration scenarios. (See data sovereignty.)
No model training on Customer Content. Anthropic API does not train on traffic by default.

Availability

Plan	Availability target	SLA credits
Starter	99.5%	None (terminate without penalty if below)
Growth	99.9%	None (terminate without penalty if below)
Scale	99.9%	Pro-rated credits on SLA addendum
Enterprise	99.95%	Full SLA in signed MSA

Incident response

Detection: Cloudflare-native alerting on error-rate anomalies, plus Sentry for runtime errors.
Triage: 24-hour acknowledgement on Growth+, 4-hour on Enterprise.
Customer notification: within 72 hours of confirming a Personal Data breach affecting Customer Content; immediate for service-wide incidents.
Post-incident: public post-mortem for any incident lasting > 15 minutes at status.truvyo.ai.

Compliance posture

GDPR / UK-GDPR: Truvyo acts as Processor; DPA available pre-signed.
CCPA / CPRA: Customer rights honored per the Privacy Policy.
HIPAA: BAA available on Enterprise tier for medical device distribution use cases.
SOC 2 Type II: In progress. Pre-audit memo available on request to Enterprise prospects.
ISO 27001: Not pursued at this stage; Cloudflare's ISO 27001 covers the underlying infrastructure.

Vulnerability disclosure

If you find a security vulnerability, please report it to security@truvyo.ai. We acknowledge within 24 hours, share a remediation timeline within 5 business days, and credit researchers in our post-incident summary unless asked to keep the report private.

We don't currently run a paid bounty program. Significant findings receive a thank-you and, where appropriate, swag and credit.

Penetration testing

Customer is permitted to conduct penetration testing of the Service against the Customer's own tenant, provided that: testing is coordinated with us at security@truvyo.ai at least 7 days in advance; testing does not target other tenants; and the Customer shares findings with us at the conclusion of the test.

Security Overview.