Privacy policy

Version 0.2 · Effective October 31, 2026 · Draft pending counsel review

This policy says what personal data TrustBox LLC of Chicago, Illinois ("TrustBox", "we") collects, why, how long we keep it and who processes it for us. It covers trustbox.dev, the customer admin at app.trustbox.dev, and the trust centers we host at tbox.page addresses and on customers' own domains. Questions or requests: privacy@trustbox.dev.

Whose data, and in what role

• Visitors and people who start signing up on trustbox.dev: we decide what we collect and why.
• Customers' staff who use customer admin: we decide what we collect to run their account.
• Agency users who sign in to a customer's trust center or call its API: we process their data for the provider whose trust center it is. The provider decides what its trust center shares and who gets in, and our data processing agreement with each customer covers that processing. Some of it, such as access logs, exists because FedRAMP's rules require the provider to keep it.

What we collect

• When you start signing up: your name, company, work email and, if you give them, your phone number, FedRAMP ID, FedRAMP status and track, the plan and trust center address you'd like, and any message. We also record where your visit came from: a campaign tag in the link, or the site that sent you. Each step is saved when you send it, so we can follow up if you stop partway. Until you press Continue, what you type stays in your browser.
• When you agree to our terms: your email address, the version of each document you agreed to, when, and the IP address and browser user agent the agreement came from, so we can show what each customer accepted.
• When you pay: our payment processor collects your card and billing address. We keep only its references to you (customer, subscription and invoice IDs), what you bought and your billing status. We never see or store your card number.
• Customers' staff: your email address, the trust centers you can manage and what your role lets you do, and a record of the changes you make (who, what, when).
• Agency users: your email address and agency, the access the trust center has granted you and when it changed, and the API clients you create.
• Access logs: each time an agency user views or downloads certification data or calls the API, we log who, which trust center, what was opened, when, the IP address and the browser's user agent. We also keep daily counts per user.
• Sign-in: the email address a sign-in link or invite was sent to and when, so links can expire and sign-in can be rate limited. Links and tokens are stored only as hashes.
• Email preferences: if you unsubscribe from our commercial email, we keep your email address on a do-not-send list. Each commercial email's unsubscribe link is stored only as a hash.
• Visits to trustbox.dev: we measure visits to trustbox.dev with cookie-free analytics that count page views, the referring site and page speed. Customer admin runs no analytics script.
• Views of a trust center's public pages: the trust centers we host for our customers run no analytics script. We count how often each one's public pages, JSON files and documents are viewed, so the customer can see it, and a count records only what was viewed and when: never the visitor's IP address, browser details, cookies or anything else that identifies them. Each customer can turn this counting off. Agency access logs are separate, and FedRAMP's rules require them. IP addresses pass through our hosting provider to deliver and protect the service; except in access logs and records of agreeing to our terms, we don't store them.

Why we use it

• To run the service: sign you in, show each user what their access allows, publish what providers make public, and send the emails the service depends on (sign-in links, invites, billing and access-denial notices).
• To give providers, their agencies and FedRAMP the access records FedRAMP's rules require: an inventory and history of agency access (CDS-TRC-AAI) and access logs with 6-month summaries (CDS-TRC-ACL).
• To contact people who start signing up about TrustBox, look up their public FedRAMP Marketplace record and prepare for a call.
• To bill customers, and to keep the service secure: rate limits, abuse prevention and an audit trail of changes.

Where a law asks for a legal basis, ours are: performing our contract with customers; our legitimate interest in running, securing and selling the service; and our customers' legal obligations under FedRAMP's rules, for access records.

We don't sell or rent personal data, use it for advertising, or use customers' content to train AI models. We don't add you to a marketing list. If we send you commercial email, every message has a working unsubscribe link.

How long we keep it

• Sign-up details: two years after the last step you saved, then deleted automatically; ask and we'll delete them sooner. Once you start checkout, they're kept with the record of what you ordered and agreed to, for as long as we keep that record; if you become a customer, they become part of your account.
• Sign-in links and invites: a sign-in link expires after 15 minutes and an invite after 7 days. Customer staff's sign-in records are deleted a day after the link expires, and agency users' sign-in records a day after the link expires too. An invite that was never accepted is deleted 30 days after it expires.
• Corrections sent from the directory: your name, email and message, for one year.
• Unsubscribe links: each link in a commercial email works for 400 days, then its record is deleted. Your choice to unsubscribe is kept on the do-not-send list.
• Sessions: a session lasts at most 8 hours, and ends when you sign out. Expired sessions are deleted.
• Agency users' accounts and access history: for as long as the provider's trust center keeps its access history, which FedRAMP's rules require the provider to keep. Grants and their changes are never deleted.
• View counts of public pages: about three months.
• Access logs: at least 400 days, so a provider can always produce the 6-month summaries FedRAMP requires. Nothing deletes them after that yet; when we set an end date, we'll put it here.
• Snapshots of a trust center kept for each Ongoing Certification Report: as long as FedRAMP's rules require the provider to keep its history, including after the provider's subscription ends.
• Customers' staff and the audit trail of changes: while the account is open. The audit trail is never edited or deleted.
• Billing records: as long as tax and accounting law require.
• Records of agreeing to our terms: for as long as the account they belong to, and then as long as we might need to show what was agreed. They're never edited.
• The do-not-send list: for good, so we never email an address that unsubscribed. Ask and we'll remove it, but we may then email it again.
• Everything else in a customer's account: deleted 30 days after the subscription ends, as our terms say. Backups expire on their normal schedule.

Who else processes it

Our subprocessors page lists every company that processes personal data for us, what for and where. We share personal data with anyone else only when the law requires it, or with a provider and FedRAMP as the provider's access records.

Cookies and browser storage

We use only cookies the service needs to work, so we don't show a cookie banner:

• __Host-tc_session (named tc_session only when TrustBox runs on a developer's own computer): keeps an agency user signed in to a trust center. It's set when you sign in and lasts at most 8 hours, or 30 minutes without using the trust center.
• tb_cp_session (named __Host-tb_cp_session on app.trustbox.dev): keeps customer staff signed in to customer admin. It lasts at most 8 hours, or 30 minutes without using customer admin.
• tb_cp_act: used only by TrustBox staff while they act as a customer in its customer admin, to help it. It lasts at most one hour.
• tb_staff_dev: used only by TrustBox staff when running the service on their own computer, never on our sites.

TrustBox staff also sign in to an internal console through a sign-in provider that sets its own essential cookie. We don't use advertising, analytics or cross-site tracking cookies. The sign-up form saves a draft of what you've typed in your browser's local storage, which stays on your device, and sending the form clears it. If we ever need a cookie that isn't essential, we'll ask first.

Your rights

You can ask to see, correct, export or delete what we hold about you, or object to how we use it. Email privacy@trustbox.dev. We'll answer within 30 days. We may need to confirm it's you first.

If you're an agency user, some of your data belongs to the provider's access records. We'll pass your request to the provider, and we can't delete records that FedRAMP's rules require the provider to keep. Depending on where you live, you may also be able to complain to a data protection authority.

Security

We encrypt data in transit and at rest, keep the service on infrastructure separate from our customers' offerings, store sign-in links and tokens only as hashes, and log access to certification data. If we learn of a breach that affects your personal data, we'll tell the affected customers promptly, and you where the law requires it.

Children

TrustBox is a business service and isn't meant for children. We don't knowingly collect children's personal data.

Changes

Each version of this policy has a number and an effective date, and earlier versions stay published at trustbox.dev/privacy with their numbers. For a material change, we email customers at least 30 days before it takes effect.

Other versions

• Version 0.1, effective October 24, 2026