Privacy Policy

At TrustChain AI, we take your privacy and the privacy of your end-users extremely seriously. As a compliance and security middleware provider, data minimization and protection are core to our architecture.

1. Data Collection and Usage

We collect the minimum amount of data necessary to provide our services:

• Account Data: Email addresses, organization details, and billing information required to maintain your account.
• Audit Logs: Metadata regarding your API requests (timestamp, token count, compliance rules triggered). We do not store the plaintext content of your prompts or responses.
• API Keys: Upstream provider credentials (e.g., OpenAI, Anthropic) are encrypted at rest using versioned AES-256-GCM with authorized server-side decryption/use when required for provider execution. TrustChain-issued API keys are stored only as HMAC-SHA256 hashes (raw value shown once and never persisted).

2. Data Processing (Middleware)

When you route requests through our proxy:

• Data is processed entirely in memory to evaluate compliance rules (e.g., PII redaction, HIPAA checks).
• Once the request is forwarded to the destination provider and the response is returned to you, the payload is immediately purged from our memory.
• We never use your data, prompts, or responses to train any artificial intelligence models.

3. Third-Party Subprocessors

We use industry-standard subprocessors to provide our services. You can view our full list of subprocessors in our Trust Center. Key infrastructure partners include:

• Vercel (Hosting)
• Supabase (Database infrastructure, hosted on AWS)
• Stripe (Payment processing)
• Clerk (Identity and Access Management)

4. Data Retention

We retain audit logs based strictly on the retention period associated with your pricing tier. After the retention period expires, audit logs are automatically and permanently deleted from our systems.

5. Security

We implement rigorous technical and organizational measures to protect your data, including HTTPS/TLS for all data in transit, versioned AES-256-GCM for provider credentials, and HMAC-SHA256 for TrustChain API keys.

6. Contact Us

If you have questions about this Privacy Policy, please contact our Data Protection Officer at privacy@trustchainai.app.