Security at Trenston

Where data lives

Vercel: The signed-in app and the marketing site are served from Vercel over HTTPS.

Render: The API is a Python FastAPI service on Render (see render.yaml), with Render cron jobs for retention checks, accounting sync, daily alerts, and the weekly digest email.

MongoDB Atlas: Primary company data (workspaces, financials, pipeline, decisions, and team records) lives in a dedicated MongoDB Atlas database (DB_NAME=trenston), not in the browser and not in a Render-managed Mongo sidecar.

Cloudflare R2: Uploaded bills, receipts, and legal files are stored in a private object bucket. Files are not publicly listed and are retrieved with short-lived signed links.

Clerk: Sign-in identity and authentication sessions are handled by Clerk (clerk.trenston.com). Trenston stores the account details needed to run your workspace, not payment cards.

Paddle: Paid subscriptions go through Paddle as merchant of record. Card numbers never pass through Trenston’s application database.

Encryption

In transit: Production traffic uses HTTPS end to end: browsers talk to Vercel over TLS; the API on Render serves HTTPS; outbound calls to Clerk, Paddle, Anthropic, Google, QuickBooks, Xero, HubSpot, SAP Business One, Resend, and R2 use TLS.

At rest: integration secrets: OAuth tokens and ERP credentials (Google, QuickBooks, Xero, HubSpot, SAP Business One) are sealed with Fernet symmetric encryption before they are written to MongoDB. The key is INTEGRATION_ENCRYPTION_KEY in Render environment config and is never committed to the repository. Production refuses to boot without a valid key.

At rest: platform storage: MongoDB Atlas and Cloudflare R2 provide their own encrypted storage for the clusters and buckets Trenston uses. Trenston does not claim an additional application-level encryption layer over every document field beyond credential sealing described above.

Third parties

Google: Optional, per-user Calendar (plus Sheets export and Drive file pick). Trenston does not request Gmail access. Tokens are personal to the teammate who connected.

QuickBooks / Xero / SAP Business One: Optional accounting sync into Financials when a workspace owner or the teammate who connected the system triggers it. SAP uses Service Layer credentials you supply; QB/Xero use OAuth.

HubSpot: Optional CRM deal sync into Pipeline and Metrics when connected.

Slack: Optional Incoming Webhook URL only, for high-severity alerts to a channel you choose. Not a full Slack OAuth app.

Anthropic: AI features (Ask Trenston, bill/receipt extract, briefing and digest summaries, decision suggestions) send the workspace context needed for that request through Anthropic's commercial API. Under Anthropic's commercial terms, inputs and outputs are not used to train its models by default, and Anthropic acts as our processor. Trenston does not train or fine-tune models on customer data.

Google Cloud Document AI: When enabled, a bill or receipt you upload may first be read by Google's Invoice Parser to pull out vendor, date, and amounts. Anything it cannot read confidently falls back to Anthropic. This is run by Trenston, not through your Google account.

Clerk, Paddle, Resend, Vercel Analytics: Auth sessions, billing as merchant of record, transactional email, and cookieless page-view analytics respectively.

Retention and deletion

Account deletion removes your personal account data from Trenston's database immediately, with no hold period on our side. Copies in infrastructure provider backups age out on the provider's own schedule.

Workspace owners can delete the company workspace; Trenston removes workspace-scoped MongoDB records and associated private R2 objects. If object storage is unreachable, deletion fails visibly so it can be retried instead of silently leaving files behind.

Workspace owners can export a data package (integration tokens stripped). Non-owners get their own account data plus a membership summary.

Trial and inactivity retention emails are driven by a daily Render cron (helm-retention-checks). They are reminders, not silent data deletion without the controls above.

Your data, your exit

It is your data: Everything your team enters or connects stays yours. Trenston uses it to run your workspace and for nothing else: no selling, no advertising, no model training.

Export it: Any user can download their own account data from Account Settings, on any plan, including Free. Workspace owners can also download a package of the whole workspace as JSON with integration tokens stripped. The package holds database records, up to 5,000 rows per collection (a flag marks any collection that was cut), and not the original uploaded files. Financials also export as PDF and Excel, or to Google Sheets.

Delete a workspace: Owners can delete a company workspace. Trenston removes the private files from storage first, then every workspace record, then the workspace itself. If storage is unreachable the deletion stops and says so, so nothing is left behind unnoticed.

Delete your account: Deleting your account removes your personal data immediately and deletes any workspace where you are the only owner. Where other people worked in a workspace, their history is kept and your name on the activity log becomes "Deleted user".

If you stop paying: Paid features lock, and your data is not deleted automatically. Account export is not tied to a paid plan, so leaving never means losing your records.

What can linger: Our database and storage providers keep their own backups for a limited time, so a deleted record can exist in a provider backup until it ages out. Ask contact@trenston.com if you need specifics.

Staff access

Trenston is founder-operated. The people who administer production (Render, Vercel, MongoDB Atlas, Cloudflare R2, Clerk, Paddle) can, in principle, reach infrastructure that holds customer data, the same as any small SaaS with shared ops credentials.

There is no separate large support organization with standing read access to every workspace. We do not browse customer financials or documents for marketing or product curiosity.

When access is needed to debug a customer-reported issue, we do it for that purpose and with the customer’s knowledge whenever practical. Prefer contacting contact@trenston.com for security or access questions.

Controls

Credentials encrypted at rest: OAuth tokens for Google, QuickBooks, Xero, and HubSpot, plus SAP Business One credentials, are Fernet-encrypted before they are stored. Encryption keys come from protected environment configuration, never from the codebase.

API keys are read-only: Personal API keys (paid plans) can only read, never change data. A key sees exactly what its owner can see in Trenston, only in that workspace. Keys are stored as one-way hashes, shown once, rate limited, and revocable at any time in Settings. Assistants connected by signing in (OAuth) get the same read-only access through tokens that last 30 days and renew with rotating refresh tokens, and can be disconnected in Settings at any time, which ends access immediately.

Access stays where it belongs: Each workspace is isolated. Role-based packs and department access limit people to the company data and actions they are authorized to use.

Private file storage: Uploaded documents stay in a private Cloudflare R2 bucket. Downloads use time-limited signed URLs rather than public file links.

Uploads are inspected: Trenston enforces a 15 MB size cap and checks PDF, PNG, and JPEG file signatures before accepting a document, reducing the risk from disguised or oversized files.

Safer web defaults: HTTPS, restrictive browser security headers on Vercel and the API, protected administrative diagnostics, and no-store API responses reduce exposure in browsers and intermediaries.

Deletion is designed to finish: Workspace deletion removes workspace-scoped database records and associated private files. If object storage is unavailable, Trenston fails visibly so deletion can be retried instead of silently leaving files behind.

API keys and AI assistants

Read-only by design: The public API has read endpoints only, and every tool in the Trenston MCP connector is marked read-only. There is no way to create, edit, approve, or delete anything in Trenston through an API key or a connected assistant.

It sees what you see, nothing more: Every request runs through the same permission checks as the app: one workspace only, your departments only, and financial figures only if you have Financials access. If your access changes, the API changes with it on the next request.

Sign in, or use a key: Assistants such as Claude connect by sending you to a Trenston consent screen (OAuth 2.1 with PKCE). Scripts and tools like Claude Code can use a personal API key instead. Both are available on every paid plan.

Expiring tokens, hashed keys: Assistant sign-in tokens last 30 days and renew with a refresh token that changes on every use; a reused old refresh token ends the connection. API keys are shown once and stored only as a one-way hash, so Trenston cannot show them to anyone again.

You can switch it off instantly: Revoke a key or disconnect an assistant in Settings, under API keys, and it stops working on the next request. Removing someone from the workspace ends all of their keys and connections for good, and deleting a workspace or account deletes them.

A consent screen that tells the truth: Before anything connects, the consent screen shows which workspace, exactly what can be read, and where the sign-in returns. Only Claude's own address is shown as verified; any other app is labeled unverified, because an app chooses its own name.

Limits and separation: Each key is limited to 60 requests a minute. API keys and assistant tokens only work on the public read-only API, never on the signed-in app, and personal Google data is never included in what assistants receive.

What leaves Trenston: When you ask a connected assistant a question, it receives the data its tools read for you, and that provider's terms then apply. Text your team wrote, such as task titles, is passed as data, and the connector tells assistants never to treat it as instructions.

Practices

Integration access is opt-in and can be disconnected at any time.

Google Calendar and Drive are personal: each teammate connects their own Google account and only sees their own meetings and files. Shared company OAuth (QuickBooks, Xero, HubSpot, SAP) can be used only by the teammate who connected them, or by a workspace owner. Legacy unstamped company connections are limited to owners until someone reconnects.

Google is not read-only. Connecting your Google account grants Calendar read and write, Sheets export, and Drive files you pick in Trenston. It does not include Gmail or your full Drive.

Payment card details are handled by Paddle, not stored on Trenston servers.

Authentication is handled by Clerk using secure session controls.

Sensitive credentials and provider token responses are excluded from application logs.

Uploaded documents are sent to Anthropic (and, when enabled, Google Cloud Document AI) only when an AI extract feature needs to process them.

GitHub is listed as coming soon in the product catalog. It is not a live data connection today.

Common questions

Is Trenston accessible?: We build toward WCAG 2.1 AA: full keyboard navigation with a visible focus ring, labelled controls, and plain-text summaries for key charts. We have not had a formal third-party accessibility audit yet. If something blocks you, email contact@trenston.com and we will fix it.

Can other companies see our workspace?: No. Queries are scoped to the signed-in workspace. Members of another company cannot read your financials, documents, or decisions.

Does Trenston store our full email inbox?: No. Trenston does not request any Gmail access, so it cannot read, store, draft, or send your email.

What Google access does Trenston request now?: Connecting your Google account requests Calendar read and write (Trenston can create or update events when you ask), Google Sheets to create a Financials export spreadsheet, and drive.file so you can pick a bill in Drive. Each teammate connects their own Google account, never a shared workspace account. Trenston does not request Gmail access. Reconnect Google to add missing write scopes.

Who can see uploaded bills and legal files?: Authorized people in your workspace. Files sit in a private bucket and are served through short-lived signed links, not public URLs.

Can an AI assistant change anything in our workspace?: No. API keys and connected assistants are read-only. They can read your briefing, decisions, tasks, your assigned work and, with Financials access, a financial summary. They cannot create, edit, approve, or delete anything.

How do we cut off an assistant or a key?: In Settings, under API keys: revoke a key or disconnect an app, and it stops working on the next request. Removing a teammate from the workspace ends all of their keys and connections permanently.

Is Trenston SOC 2 or ISO 27001 certified?: Not yet. We do not claim SOC 2, ISO 27001, HIPAA, or similar certifications we have not earned. This page describes the controls that are in the product and infrastructure today.

Where is the API hosted?: Render (web service helm-company-cockpit), with MongoDB Atlas as the database. The frontend is on Vercel. Health is exposed at /api/health and summarized on the public Status page.