Trust, Security & Data Locations

How TrustXP is built, where your data is stored, who processes it on our behalf, and the controls we use to keep it safe. Written for customers, prospective customers, and the security and privacy reviewers who evaluate us.

Last updated: 24 August 2026

This is a transparency overview. It supplements, but does not replace, our Privacy Policy, Terms of Service, and Data Processing Addendum.

1. How TrustXP Is Hosted

TrustXP runs entirely on managed cloud infrastructure. We do not own or operate physical servers, and we do not run TrustXP in a customer's own environment.

ComponentHosted byRegionAddress
Platform app - the dashboard your admins useVercelGlobal edge networkplatform.trustxp.com
Pulse app - where your people answer pulsesVercelGlobal edge networkpulse.trustxp.com
API and background processingRailwayEU (Netherlands, EU West)api.trustxp.com
Primary databaseRailway managed PostgreSQLEU (Netherlands, EU West)Private network only
  • All customer data lives in one place. Every record is stored in a single PostgreSQL database hosted in the European Union.
  • The web apps hold no data. The front-end applications are static JavaScript delivered by a CDN. They store nothing; they read and write through the API.
  • The database is not publicly addressable. The API reaches it over a private internal network.
  • We use no file or object storage. TrustXP does not accept uploads, so there are no documents, images, or exports sitting in a bucket.

Separate environments. Product demonstrations and internal testing never touch production. Our demo environment runs the same application code against its own database, its own API service, and its own identity provider instance, seeded exclusively with synthetic sample data. In that environment, outbound email is structurally disabled and no scheduled jobs run.

2. What We Store

All of the below lives in the production PostgreSQL database described above.

WhatExamplesWhy we hold it
Organization profileOrganization name, plan, time zone, pulse schedule settingsConfiguring and running your workspace
Administrator accountsName, work email, identity-provider user ID, last sign-inSigning your admins in and controlling what they can see
People who receive pulsesName, work email, role, team, start date, active statusKnowing who to invite to each pulse
Pulse contentPulse titles, schedules, status, question text and dimensionRunning the survey itself
ResponsesA 1-5 score, an optional written comment, the dimension, and a timestampThe feedback your organization acts on, stored without a link to the person who wrote it (see section 3)
Scores and trendsAggregated dimension scores, contributor counts, historical snapshotsYour dashboard, trend lines, and reporting
Alerts and follow-upsAlert text, suggested playbook, owner, dismissed stateFlagging movements and tracking what you do about them
Email delivery eventsRecipient address and delivery outcome (sent, delivered, bounced, complained)Making sure invitations arrive, and suppressing addresses that bounce
Audit historyWho did what, when, in which organizationSecurity review and change tracking
BillingPayment-processor customer and subscription identifiers, plan, status, billing periodManaging your subscription

What we deliberately do not store

  • Card numbers and payment details. These go directly to Stripe. We hold only Stripe's identifiers and the resulting subscription status.
  • Passwords, password hashes, or multi-factor secrets. Authentication is handled by Clerk. We store a user identifier, name, and email, never a credential.
  • Session tokens. Sessions are issued and held by Clerk in the user's browser; our API only validates short-lived signed tokens on each request.
  • Uploaded files or media. The product has no upload feature.
  • Tracking of individuals across the web. We do not sell data, and we do not use customer data to build advertising profiles.

3. How Response Anonymity Works

Anonymity is the reason people answer honestly, so it is enforced by how the system is built, not by a policy promise.

  • Responses carry no link to a person. A submitted response is stored with the score, the optional comment, the dimension, and the time, and no reference to the individual's record. There is no path from a response row to a named person in the part of the system your administrators can reach.
  • Delivery tracking is kept separate. To send invitations and know who still needs to respond, we necessarily track which invitation went to which person. That mapping lives in a separate, internal part of the database and is never exposed through any customer-facing screen, report, export, or API endpoint. No one in your organization can query it.
  • Small groups are never shown. Scores and comments for a dimension only appear once enough people have contributed to that dimension. Below that threshold, the dashboard shows nothing rather than showing something that could be traced back to an individual.
  • Comments are surfaced as written. We do not attach names, teams, or identifiers to a comment when displaying it.
The practical guarantee: an administrator using TrustXP can see what their organization said, and cannot see who said it.

4. Who Processes Data on Our Behalf

These are our subprocessors. Each is bound by a data processing agreement, and each publishes its own security and compliance documentation.

ProviderWhat they do for usWhat they see
RailwayHosts our application servers and the primary databaseAll application data, at rest and in their infrastructure
VercelHosts and delivers the three web applicationsNo stored customer data - static assets and request metadata only
ClerkAuthentication and identityAdministrator names, emails, and sign-in activity
ResendSends pulse invitation and reminder emailsRecipient email addresses and delivery outcomes
StripeSubscription billing and paymentsBilling contact and payment details of the paying customer
MailerLiteEmail list and newsletter deliverySubscriber email addresses and signup tags. Data processed in EU (Germany and the Netherlands)

We will update this list before adding a new subprocessor that handles customer personal data.

5. Security Controls

  • Encryption in transit. Every public endpoint is served over HTTPS (TLS 1.2 or higher). Connections to the database are encrypted as well.
  • Encryption at rest. Database storage volumes and deployment storage are encrypted at rest by our infrastructure providers.
  • Authentication. Sign-in, session management, and multi-factor options are handled by Clerk. Our API rejects any request without a valid, short-lived, signed session token.
  • Tenant isolation. Every database query is scoped to the organization of the person making the request, resolved on the server from their authenticated identity, never from anything the browser sends. One customer's data cannot be reached from another customer's session.
  • Least-privileged internal access. Internal administrative tooling is on a separate application, requires an explicitly granted administrator role, and is not reachable with an ordinary customer account.
  • Verified webhooks. Billing and email-delivery callbacks from Stripe and Resend are cryptographically verified before we act on them, so a forged request cannot change a subscription or a delivery record.
  • Controlled schema changes. Database changes are version-controlled, reviewed, and applied automatically as part of a deployment, before new code begins serving traffic. Every change runs through an automated test suite against a separate test database first.
  • Supply-chain hygiene. Third-party dependencies are pinned, and newly published package versions are not adopted until they have been public for at least 24 hours, a guard against compromised releases.

6. Data Residency and International Transfers

Your organization's data is stored and processed in the European Union (Netherlands). Both the application servers and the database sit in that region.

Two qualifications, stated plainly:

  • Static assets are delivered globally. The web applications are served from a worldwide CDN, so the JavaScript and styling for the app may be delivered from a location near your user. No customer data is stored there.
  • Some subprocessors operate outside the EU. Authentication (Clerk), email delivery (Resend), and payments (Stripe) may process the limited data described in section 4 in the United States or elsewhere.

Where personal data is transferred outside the European Economic Area, we rely on the applicable providers' Standard Contractual Clauses and data processing addenda.

7. Backups, Logs, and Retention

  • Backups. The production database is backed up automatically by our managed database provider, and can be restored by our team.
  • Application logs. Runtime and deployment logs are retained by our hosting provider for a limited period. We do not log request bodies or response content in normal operation.
  • Email history. Delivery events are retained so that we can continue to suppress addresses that bounce or mark our mail as spam.
  • Audit history. Administrative actions are retained for security review.
  • Account data. We retain your data for the life of your account, and for a limited period afterwards where required for legal, tax, or accounting purposes.
  • Deletion. On request, we will delete your organization's data. Where data has already been passed to a subprocessor (for example a billing record at Stripe), deletion follows that provider's own retention rules and any legal obligation we have to keep financial records.

8. Contact

TopicWhere to write
Privacy questions, data access or deletion requestsprivacy@trustxp.com
Security concerns or vulnerability reportssecurity@trustxp.com

We respond to privacy and security inquiries within the timeframes required by applicable law, and we ask that vulnerability reports be sent to us before they are disclosed publicly.

Compliance Documents

Download the documents your security or procurement team needs to evaluate TrustXP.

Privacy Policy Terms of Service Data Processing Addendum

Your Team's Trust Score Exists Right Now.
You Just Can't See It Yet.

Launch your first pulse today. Three minutes to set up. Your team responds in 30 seconds.

Start free →
No credit card required. Free for teams ≤10. First pulse free for everyone.