Security Architecture
Multi-layer tenant isolation & encryption
Every control is applied at the infrastructure level — not just as a policy. Your data stays yours, scoped by cryptographic boundary.
PostgreSQL Row-Level Security
Tenant-bound database access is enforced by PostgreSQL Row-Level Security. Privileged service paths are separately restricted and audited.
AES-256-GCM Credential Encryption
Provider credentials are encrypted at rest using versioned AES-256-GCM and decrypted only within authorized server-side execution paths when required to call the configured provider.
HMAC-SHA256 API Key Integrity
TrustChain-issued API keys are stored only as HMAC-SHA256 hashes. The raw value is shown once at creation and never persisted. Verification is constant-time to prevent timing attacks.
Tamper-Evident Append-Only Audit Trail
Every proxied request generates a tamper-evident audit log entry. Log records cannot be modified or deleted through the application layer. Retention duration is configured per-plan.
AI Provider Boundary
Compliance proxy gateway
TrustChain sits between your application and any LLM provider. No prompt reaches a provider without first passing the inspection layer.
Prompt Inspection Before Forwarding
Every inbound prompt is evaluated against the active ruleset — covering PII patterns, HIPAA PHI markers, GDPR-sensitive content, and custom organisational rules — before the request is forwarded.
Drop-in API Replacement
Compatible endpoints mirror the OpenAI, Anthropic, and Google Gemini APIs. Your provider credentials remain encrypted at rest and are used exclusively within authorized server-side execution paths.
Incident Detection & Response
Violations trigger immediate blocking, incident record creation, and optional webhook notification. Every blocked request is logged with rule ID, severity, and matched content hash.
Agent & Tool Governance
MCP protocol boundary & human oversight
AI agents operating through TrustChain are subject to policy-based tool call governance, human-in-the-loop approval gates, and complete invocation evidence.
MCP Protocol Governance (Capability)
TrustChain implements MCP governance capabilities. When this feature is actively enabled in a production environment, tool calls from AI agents are routed through a Model Context Protocol boundary where policies define permitted actions.
Human-in-the-Loop Approval Controls
High-risk or sensitive tool invocations require explicit human approval before the agent may proceed. Approvals are time-bounded and logged to the audit trail.
Tool Invocation Evidence Trail
When MCP tool execution is enabled, TrustChain applies versioned tool policies, approval controls, transaction safeguards, and invocation evidence.
Data Handling
What we store, what we don't, and for how long
Customer data is never used for model training
Prompts and responses are processed in-memory for compliance evaluation. Payload content is never persisted to disk, used to fine-tune models, or shared with AI providers beyond the original proxied request.
| Plan Tier | Audit Log Retention | Prompt Content | Encryption |
|---|---|---|---|
| Free | 7 days | Never stored | HTTPS/TLS |
| Starter | 30 days | Never stored | HTTPS/TLS |
| Growth | 90 days | Never stored | HTTPS/TLS |
| Enterprise | 1 year (customisable) | Never stored | HTTPS/TLS |
Encryption at Rest
Infrastructure databases are encrypted at rest. At the application layer, Provider credentials receive versioned AES-256-GCM encryption.
Encryption in Transit
TrustChain production endpoints use encrypted HTTPS/TLS connections. Connections from TrustChain to AI providers are also TLS-encrypted end-to-end.
In-Memory Processing Only
Prompt and response payloads are processed in memory for policy evaluation and are not persisted by TrustChain. Retention policies apply to audit, evidence, and governance records rather than raw prompt or response content.
Framework Support
Designed to support evidence collection
TrustChain is designed to help organisations demonstrate responsible AI practices and collect audit evidence. These are design-time supports — not certifications.
Important: TrustChain AI is not certified under any of the frameworks listed below. The controls described are designed to help your organisation gather evidence and build processes that support your own compliance programmes. Always consult qualified legal and compliance advisors.
TrustChain's audit trail, incident logging, governance controls, and risk scoring are designed to help organisations collect evidence aligned with the NIST AI Risk Management Framework (GOVERN, MAP, MEASURE, MANAGE).
TrustChain's transparency controls, human oversight mechanisms, and audit logging are designed with the EU AI Act's high-risk system requirements in mind. This is design-time guidance only — not a conformity assessment.
TrustChain provides tamper-evident audit trail infrastructure designed to support your organisation's SOC 2 audit evidence collection. TrustChain AI has not completed a SOC 2 Type II audit.
Security Contact
To report a security vulnerability, suspected data incident, or responsible disclosure, contact our security team directly. We aim to acknowledge reports within 24 hours.
security@trustchainai.appInfrastructure Sub-processors
Key infrastructure partners used to deliver TrustChain AI:
- Vercel — Edge hosting & deployment
- Supabase (AWS) — Database infrastructure
- Stripe — Payment processing
- Clerk — Identity & access management
Security & Compliance FAQ
Are my prompts stored?
No. TrustChain processes prompts in-memory to evaluate them against active policies. The plaintext content of prompts and responses is never persisted to disk or used for training models. Only metadata (e.g., token count, violation type) is stored in the audit log.
How are my provider API keys secured?
Third-party API keys (like OpenAI or Anthropic credentials) are encrypted at rest using versioned AES-256-GCM. We decrypt them only within authorized server-side execution paths when forwarding a request.
Is TrustChain certified for HIPAA or PCI-DSS?
TrustChain is an infrastructure tool that supports your compliance efforts by applying inline policy controls and generating evidence. However, we are not certified under HIPAA, PCI-DSS, or similar frameworks. You remain responsible for your application's overall compliance.
This document is updated when controls change. Privacy Policy · Terms of Service