Security & Trust

1. Our approach to security

Security at TriveniCo is an ongoing set of practices and controls, not a one-time checkbox. This page describes what TriveniCo does today, in plain language, so you can trust where your data lives and how it is protected.

2. Encryption in transit and at rest

All traffic between your browser and TriveniCo is encrypted in transit using TLS, so data cannot be read or altered in flight. Data at rest is encrypted on TriveniCo's storage systems, including databases and file storage.

TriveniCo keeps protocol and cipher configuration current and disables older, weaker versions as they become obsolete.

3. Authentication and sessions

Account passwords are hashed with a strong one-way function and are never stored in plain text. TriveniCo issues secure, signed session tokens rather than storing credentials in the browser, and sessions expire automatically after a period of inactivity.

Where multi-factor authentication is available, TriveniCo encourages enabling it, and account security events such as new-device sign-ins are logged for review.

4. Payment security

TriveniCo never stores full card numbers on its own servers. Payments are processed by Stripe, a PCI DSS Level 1 service provider. When you enter card details, they are tokenized by Stripe, and TriveniCo only ever receives and stores a token reference, not the card number itself.

5. Infrastructure and monitoring

TriveniCo runs on Cloudflare's network and services, including D1, R2, and KV storage. Systems emit structured logs and monitoring signals, and TriveniCo maintains alerting for unusual activity such as repeated failed sign-ins, unexpected traffic patterns, and changes to production configuration.

Dependencies are updated regularly, and TriveniCo runs vulnerability scanning against its code and infrastructure to catch known issues early.

6. Access controls

Access to production systems follows the principle of least privilege. Employees are granted role-based access only to the systems they need, production access is temporary and audited, and secrets are stored in a managed secret store rather than in code or configuration files.

7. Incident response

TriveniCo maintains an incident response process for containing and recovering from security events. When an incident affects user data, TriveniCo works to contain it, assess the impact, and notify affected users where required by law or where it would help them protect themselves.

8. Vulnerability disclosure

If you discover a security vulnerability in TriveniCo, report it to security@trivenico.com. TriveniCo welcomes reports from researchers acting in good faith, will not pursue legal action against good-faith reporters, and will acknowledge reports, work to fix confirmed issues, and credit researchers where appropriate.

9. What you can do to stay safe

• Use a strong, unique password and enable multi-factor authentication where available.
• Watch for phishing: TriveniCo will never ask for your password or payment details over email.
• Keep your browser and devices updated.
• Report anything suspicious to support@trivenico.com.