Training data in trusted hands

Hosted in the Netherlands

The API and the database run on servers in the Netherlands, in TransIP's ISO 27001-certified data centres. Uploaded files are kept in Google Cloud storage, primarily within the EU.

Data processing agreement

Every customer can sign a data processing agreement with us under Article 28 GDPR, covering our security measures, audit rights and our commitment to report a data breach within 24 hours.

Minimal data sharing

A sub-processor receives only the data it needs for its task. We have a data processing agreement with every sub-processor, supplemented by EU Standard Contractual Clauses or the EU-US Data Privacy Framework for parties in the US.

Anonymised test and demo data

We never use real customer data for testing or demos. A copy is fully anonymised first: fictitious names, email addresses and organisations. AI features powered by OpenAI do not use your data to train models.

Always a way out

If you leave Trivle, you get one standard export of your data (CSV/JSON and files) free of charge, on request within 30 days after the end of the agreement. We then delete your personal data within two months.

Certification and GDPR

Trivle itself is not yet ISO 27001 certified; we aim to be certified in 2027. Our hosting does run in ISO 27001-certified data centres, and you can assess our measures through the data processing agreement and a security questionnaire. We process personal data in line with the GDPR: with a data processing agreement, hosting and storage in Europe, a public list of sub-processors and notification of a data breach within 24 hours.

API-first by design

No frontend talks to the database directly: everything goes through our API. Integrations and AI assistants (MCP) authenticate with OAuth 2.0, using access tokens that expire after one hour.

Tenant scoping in the data model

Every query on customer data is automatically limited to your environment. The separation lives in the data model itself, not in individual checks that a new feature could forget.

Roles and permissions

Learner, trainer, administrator or business manager: server-side policies decide per role what someone may see and do.

Encryption

Sensitive data is never stored in readable form.

• All traffic over HTTPS (TLS)
• Passwords hashed with bcrypt
• API tokens stored only as hashes, and they expire
• 2FA secrets, recovery codes and webhook secrets encrypted

Audit trails

Changes to participants, organisations, trainings, modules, invitations and settings are recorded: who, what and when. Learning progress is kept in an immutable event log. Support can only view an account after verifying with a one-time code, and every session is logged with its reason, time and IP address.

Two-factor authentication

Besides your password, you sign in with a code from an authenticator app. 2FA is mandatory for administrators and business managers, who get a short transition period to set it up. Recovery codes get you back in if you lose your phone.

Verified email addresses

You can only sign in with a confirmed email address. When you add an address, it only works after you click the verification link, and that link expires after a while.

Passwords and sessions

Even if a password leaks or a device goes missing, the damage stays limited.

• At least 8 characters, with an uppercase letter and a number or symbol
• Temporarily blocked after five failed sign-in attempts
• Forgot password never reveals whether an account exists
• Changed your password? Your other sessions are signed out right away
• Sessions expire on their own: after 7 days on the web, 30 days in the app

We know who we are talking to

We know our customers and who is on the line. We don't simply carry out sensitive changes, such as adjusting roles, access or your organisation's details, based on a phone call or email. And we will never ask for your password or 2FA code.

Automated pipeline

Every change goes through version control and code review, and we check it visually too. The pipeline checks code style and runs more than 4,000 automated tests; we only deploy when everything passes. Test and production are separate environments.

Package audits

Dependabot proposes updates to our dependencies every week, we audit packages for known vulnerabilities, and our server management flags updates for the servers.

Patch policy

When a serious vulnerability comes up, we act right away: as soon as a patch is released, we test and install it. The SLA sets two business days for critical and ten business days for high vulnerabilities as the outer limits. Everything else follows in regular releases.

Offsite backups and restore

The database is backed up automatically at least daily to an offsite location, and backups are kept for 30 days. We test restoring every month.

• At most 24 hours of data loss (RPO)
• Platform restored within 8 business hours (RTO)

Monitoring and telemetry

Application errors are reported to Sentry, so we often see and fix problems before anyone reports them. Scheduled jobs are monitored too: if one fails to run, we know.

99.9% availability

Our standard SLA commits to 99.9% availability per month, measured independently. If we miss it, you get a discount on that month's fee: up to 50%.

Predictable maintenance

We schedule planned maintenance at quiet times, outside office hours, so you notice as little of it as possible. Larger maintenance is announced at least two business days in advance.

When something breaks

For a critical incident you hear from us within one business hour, receive an update at least every two hours, and get an incident report with root cause and measures within five business days.

Support with a face

On business days from 09:00 to 17:00 Amsterdam time (CET/CEST) via support@trivle.com or by phone. You talk directly to the people who build Trivle, with no call centre or layers in between.