Trust center
TrustBox trust center
How we protect the certification data you share through TrustBox, what we hold today and what we don't, and how to reach us.
This page is also available as JSON.
Security
Separate infrastructure
Your trust center runs on infrastructure separate from your cloud service offering, so agencies can still reach your certification data when your service is down.
Trust centers and the customer admin app load no third-party scripts.
Encryption
Data is encrypted in transit (TLS) and at rest (AES-256), and our sites tell browsers to reach them only over HTTPS.
Sign-in links, sessions and API tokens are random values. We store only a hash of each, so a copy of our database can't be used to sign in.
Access control
Agency users sign in with a single-use link sent to their work email, valid for 15 minutes. Agency systems use the API with OAuth 2.0 client credentials, and a permission taken away stops working on live tokens at once.
Your team's permissions come from their roles. TrustBox staff reach our internal console only through single sign-on, and every staff change to an account is recorded with who made it.
Secure development
Every code change runs our automated tests and lint checks and gets an independent code review before it merges. Changes to sign-in, permissions, payments or tenant isolation get two.
Vulnerability disclosure
Email security@trustbox.dev. We acknowledge reports within 3 business days and send our assessment within 10. Our disclosure policy covers scope and safe harbor.
Compliance
What we hold today
TrustBox holds no security certifications or third-party attestations today. FedRAMP's rules don't require a trust center to hold its own FedRAMP authorization, and TrustBox has none. When that changes, this page will say so and link the evidence.
Built for the CR26 rules
TrustBox is built for FedRAMP cloud service providers and the CR26 Certification Data Sharing rules. We track every rule in FedRAMP's list as met or not met yet, and a rule counts as met only when an automated test named for it passes. How we check them.
Using TrustBox doesn't by itself satisfy FedRAMP's rules for your offering; you remain responsible for that.
Access records
Every agency page view, download and API call is logged. You see who accessed what, with monthly and six-month summaries you can export. Raw access logs are kept for at least 400 days.
Privacy
How we use data
We don't sell or rent personal data, use it for advertising, or use customers' content to train AI models. Our privacy policy says what we collect, why and for how long.
No tracking on trust centers
Trust centers run no analytics script. We count views of their public pages without the visitor's IP address, browser details or cookies, and each customer can turn that counting off. Agency access logs are separate, because FedRAMP's rules require them.
Your data and your agencies' data
For agency users, we process data on your behalf under our data processing agreement. When a subscription ends, the account's data is deleted after 30 days, except the snapshots and access records FedRAMP's rules require you to keep.
Reliability
Availability pages
Each trust center's availability page runs as its own service with its own database, so it keeps reporting while the trust center itself is down.
History that can't be rewritten
Each Ongoing Certification Report freezes a snapshot of your certification data in storage that locks it against change or deletion. Earlier versions of your documents are kept.
Data location
We ask our hosting provider to place our databases and file storage in eastern North America. That is a placement request, not a contractual data-residency guarantee. If you need one, tell us.
Resources
- StatusTrustBox's availability over the last 30 days, checked every 5 minutes, with incidents. Also as JSON.
- Security and vulnerability disclosureHow TrustBox is secured, and how to report a problem.
- security.txtOur security contact, in the standard machine-readable format.
- Privacy policyWhat personal data we collect, why, and how long we keep it.
- Terms of serviceThe terms for using TrustBox.
- Data processing agreementHow we process customers' data on their behalf.
- SubprocessorsEvery company that processes personal data for us, what for and where.
Subprocessors
| What for | Where |
|---|---|
| Hosting, edge network, database, file storage and email delivery | United States; we ask for data to be placed in eastern North America |
| Payments, subscriptions and invoices | United States |
The full list, with what each one processes and where: subprocessors.
Questions
Does TrustBox hold any certification, from FedRAMP or anyone else?
No. TrustBox holds no certifications or third-party attestations today. FedRAMP's rules don't require a trust center to hold its own FedRAMP authorization.
Do agencies need us to approve each request for access?
No. People whose work email is at a federal domain on CISA's list of .gov domains, or at .mil, get access as soon as they sign in, as FedRAMP's rules expect. Every access is logged for you.
Where is our data stored?
We ask our hosting provider to place our databases and file storage in eastern North America. That is a placement request, not a contractual data-residency guarantee. Requests are served from the data center nearest the visitor.
Do you use our content to train AI models?
No.
What happens to our data if we cancel?
The account's data is deleted 30 days after the subscription ends. Snapshots and access records stay for as long as FedRAMP's rules require you to keep them.
How do we report a security problem?
Email security@trustbox.dev. Our disclosure policy says what to include and how fast we respond.
Contact
- Securitysecurity@trustbox.dev
- Privacyprivacy@trustbox.dev
- Supportsupport@trustbox.dev