{"profile":{"name":"TrustBox","tagline":"How we protect the certification data you share through TrustBox, what we hold today and what we don't, and how to reach us.","website":"https://trustbox.dev"},"sections":[{"id":"infrastructure","pillar":"security","title":"Separate infrastructure","body":"Your trust center runs on infrastructure separate from your cloud service offering, so agencies can still reach your certification data when your service is down.\n\nTrust centers and the customer admin app load no third-party scripts."},{"id":"encryption","pillar":"security","title":"Encryption","body":"Data is encrypted in transit (TLS) and at rest (AES-256), and our sites tell browsers to reach them only over HTTPS.\n\nSign-in links, sessions and API tokens are random values. We store only a hash of each, so a copy of our database can't be used to sign in."},{"id":"access-control","pillar":"security","title":"Access control","body":"Agency users sign in with a single-use link sent to their work email, valid for 15 minutes. Agency systems use the API with OAuth 2.0 client credentials, and a permission taken away stops working on live tokens at once.\n\nYour team's permissions come from their roles. TrustBox staff reach our internal console only through single sign-on, and every staff change to an account is recorded with who made it."},{"id":"development","pillar":"security","title":"Secure development","body":"Every code change runs our automated tests and lint checks and gets an independent code review before it merges. Changes to sign-in, permissions, payments or tenant isolation get two."},{"id":"disclosure","pillar":"security","title":"Vulnerability disclosure","body":"Email [security@trustbox.dev](mailto:security@trustbox.dev). We acknowledge reports within 3 business days and send our assessment within 10. Our [disclosure policy](https://trustbox.dev/security#disclosure) covers scope and safe harbor."},{"id":"certifications","pillar":"compliance","title":"What we hold today","body":"TrustBox holds no security certifications or third-party attestations today. FedRAMP's rules don't require a trust center to hold its own FedRAMP authorization, and TrustBox has none. When that changes, this page will say so and link the evidence."},{"id":"cr26","pillar":"compliance","title":"Built for the CR26 rules","body":"TrustBox is built for FedRAMP cloud service providers and the CR26 Certification Data Sharing rules. We track every rule in FedRAMP's list as met or not met yet, and a rule counts as met only when an automated test named for it passes. [How we check them](https://trustbox.dev/security#cr26).\n\nUsing TrustBox doesn't by itself satisfy FedRAMP's rules for your offering; you remain responsible for that."},{"id":"access-records","pillar":"compliance","title":"Access records","body":"Every agency page view, download and API call is logged. You see who accessed what, with monthly and six-month summaries you can export. Raw access logs are kept for at least 400 days."},{"id":"data-use","pillar":"privacy","title":"How we use data","body":"We don't sell or rent personal data, use it for advertising, or use customers' content to train AI models. Our [privacy policy](https://trustbox.dev/privacy) says what we collect, why and for how long."},{"id":"analytics","pillar":"privacy","title":"No tracking on trust centers","body":"Trust centers run no analytics script. We count views of their public pages without the visitor's IP address, browser details or cookies, and each customer can turn that counting off. Agency access logs are separate, because FedRAMP's rules require them."},{"id":"customer-data","pillar":"privacy","title":"Your data and your agencies' data","body":"For agency users, we process data on your behalf under our [data processing agreement](https://trustbox.dev/dpa). When a subscription ends, the account's data is deleted after 30 days, except the snapshots and access records FedRAMP's rules require you to keep."},{"id":"availability","pillar":"reliability","title":"Availability pages","body":"Each trust center's availability page runs as its own service with its own database, so it keeps reporting while the trust center itself is down."},{"id":"history","pillar":"reliability","title":"History that can't be rewritten","body":"Each Ongoing Certification Report freezes a snapshot of your certification data in storage that locks it against change or deletion. Earlier versions of your documents are kept."},{"id":"data-location","pillar":"reliability","title":"Data location","body":"We ask our hosting provider to place our databases and file storage in eastern North America. That is a placement request, not a contractual data-residency guarantee. If you need one, tell us."}],"resources":[{"title":"Status","href":"https://status.trustbox.dev/trustbox/","description":"TrustBox's availability over the last 30 days, checked every 5 minutes, with incidents. Also as JSON."},{"title":"Security and vulnerability disclosure","href":"https://trustbox.dev/security","description":"How TrustBox is secured, and how to report a problem."},{"title":"security.txt","href":"https://trustbox.dev/.well-known/security.txt","description":"Our security contact, in the standard machine-readable format."},{"title":"Privacy policy","href":"https://trustbox.dev/privacy","description":"What personal data we collect, why, and how long we keep it."},{"title":"Terms of service","href":"https://trustbox.dev/terms","description":"The terms for using TrustBox."},{"title":"Data processing agreement","href":"https://trustbox.dev/dpa","description":"How we process customers' data on their behalf."},{"title":"Subprocessors","href":"https://trustbox.dev/subprocessors","description":"Every company that processes personal data for us, what for and where."}],"subprocessors":[{"purpose":"Hosting, edge network, database, file storage and email delivery","location":"United States; we ask for data to be placed in eastern North America"},{"purpose":"Payments, subscriptions and invoices","location":"United States"}],"faq":[{"question":"Does TrustBox hold any certification, from FedRAMP or anyone else?","answer":"No. TrustBox holds no certifications or third-party attestations today. FedRAMP's rules don't require a trust center to hold its own FedRAMP authorization."},{"question":"Do agencies need us to approve each request for access?","answer":"No. People whose work email is at a federal domain on CISA's list of .gov domains, or at .mil, get access as soon as they sign in, as FedRAMP's rules expect. Every access is logged for you."},{"question":"Where is our data stored?","answer":"We ask our hosting provider to place our databases and file storage in eastern North America. That is a placement request, not a contractual data-residency guarantee. Requests are served from the data center nearest the visitor."},{"question":"Do you use our content to train AI models?","answer":"No."},{"question":"What happens to our data if we cancel?","answer":"The account's data is deleted 30 days after the subscription ends. Snapshots and access records stay for as long as FedRAMP's rules require you to keep them."},{"question":"How do we report a security problem?","answer":"Email [security@trustbox.dev](mailto:security@trustbox.dev). Our [disclosure policy](https://trustbox.dev/security#disclosure) says what to include and how fast we respond."}],"contact":[{"label":"Security","email":"security@trustbox.dev"},{"label":"Privacy","email":"privacy@trustbox.dev"},{"label":"Support","email":"support@trustbox.dev"}]}