Trust & Security
Security & Privacy at Trinitite
Security isn't a feature we bolt on: it's the architecture we build from. Every layer of the Trinitite platform is designed with defense-in-depth to protect your data, enforce compliance, and provide cryptographic proof of governance.
Governance
Architecture-first security
Trinitite is built on Hexagonal Architecture (Ports and Adapters), a design pattern that enforces security principles structurally rather than as an afterthought. Every security boundary is defined as a formal interface: authentication, database access, logging, and secrets management are all isolated, injectable, and independently verifiable.
Our security policies are based on the following foundational principles:
Access is limited to only those with a legitimate business need, granted on the principle of least privilege. Every API key carries scopes, every user carries only the roles they need.
Security controls are layered according to defense-in-depth, enforced simultaneously at the application layer, the database layer, and the infrastructure layer. If any single layer is compromised, the others maintain protection.
Controls are applied consistently across all areas of the platform, enforced structurally through the architecture. External systems (databases, identity providers, log sinks) can be replaced without touching core security logic.
All security controls are deployment-agnostic: present whether the system is self-hosted in your data center, running in a private cloud, or operating in a hybrid configuration. No security control depends on a specific vendor or infrastructure provider.
Compliance
Built for regulated industries
Trinitite's security controls are designed to satisfy the technical requirements of major compliance frameworks from day one.
SOC 2 Type II
Controls Implemented
Logical access controls, immutable audit logging, cryptographic integrity, encryption at rest and in transit, disaster recovery with tested RTOs.
GDPR
Compliant
Data minimization, right-to-erasure compatibility, per-organization data residency enforcement, consent verification, and data portability.
HIPAA
Compliant
Role-based access controls, MFA enforcement, immutable audit trails with hash chain verification, TLS transmission security for all connections.
FedRAMP
Aligned
Multi-factor authentication, configurable session management, password complexity enforcement, comprehensive audit trails.
Data Sovereignty
Your data never leaves your infrastructure
Trinitite is a self-hosted platform by design. The entire system, the Control Plane, the Inference Service, and the Training Service, runs inside your own infrastructure. This has direct security implications that most SaaS governance platforms cannot match:
- All governance logs, AI inference results, and user data live exclusively in your database, behind your firewall
- No Trinitite employee or system has access to your data: there is no telemetry, no phone-home, and no external data egress
- You control the encryption keys, the database, the network policies, and the backup schedule
Full Self-Hosted
All services on-premises or in your private cloud
Hybrid
Control Plane on-premises with optional managed AI services
Managed (Planned)
Full managed offering with regional deployment
Data Protection
Layered encryption at every boundary
Data at Rest
- API keys are cryptographically hashed before storage: the raw key is shown only once at creation and cannot be recovered
- User passwords are hashed with bcrypt using automatic salting; plaintext passwords are never written to any storage layer or log
- Session tokens and verification tokens are hashed before database storage, time-limited, and single-use
- MFA secrets are stored encrypted; backup codes are individually hashed and consumed upon use
- Every tenant-facing row carries organization-level scoping for complete data isolation
Data in Transit
- TLS encryption for all external-facing connections
- Database connections support TLS/SSL encryption in all deployment modes
- Internal service-to-service communication operates over private network channels within the deployment perimeter
- HSTS and modern cipher suites enforced where applicable
Secret Management
- Dedicated secrets management abstraction supporting multiple production backends
- Production adapters for AWS Secrets Manager, Azure Key Vault, and HashiCorp Vault
- Secrets are never hardcoded, injected via container orchestrator or retrieved from a dedicated secrets manager at startup
- Encryption keys managed through customer-controlled key management systems
Cryptographic Integrity
Tamper-evident cryptographic audit trail
Every governance decision logged by the platform produces a cryptographic State Tuple, a deterministic, fully-specified snapshot of the decision including the timestamp, identifiers, conversation input, governance outcome, and a hash of the active policy that produced the decision.
Each State Tuple is SHA-256 hashed and linked to the previous entry in a Merkle chain construction, identical in structure to a blockchain. This makes the audit trail mathematically tamper-evident.
Tamper Detection
Modifying any single log entry, even one field, invalidates its hash and breaks every chain hash that follows. The break is detectable by recomputing the chain.
Non-Repudiation
A verified chain proves that governance decisions occurred exactly as recorded, in exactly that order, with exactly that policy active at the time.
Deterministic Replay
Because the full state tuple is stored, any governance decision can be replayed and verified against the original log for forensic audit or regulatory review.
Chain Verification
An automated verification function walks the entire chain for an organization, recomputes every hash, and reports the exact index of any tampered entry.
a3f7c2
prev: NULL
Genesis
8b01d9
prev: a3f7c2
Entry 2
e4f529
prev: 8b01d9
Entry 3
7c3a1b
prev: e4f529
Entry N
SHA-256 hash chain, Merkle chain construction
Immutability
Write-once, read-many audit logs
Beyond the cryptographic hash chain, audit log tables are enforced as immutable at the database level, a separate, independent control that operates even if the application layer is compromised.
Database triggers unconditionally block any attempt to update or delete protected records, regardless of who issues the command. Application code, admin consoles, and direct database clients are all subject to the same enforcement.
New logs can always be written, and existing logs can always be read. The immutability is enforced at the operation level, not via access controls that can be bypassed.
GDPR Compatibility
When a user exercises the right to erasure, the system records a redaction specifying which fields should be suppressed. Personal data fields are replaced with redaction markers in the display layer. The audit record of the governance event is preserved for legal defensibility; only the personal data is suppressed.
user_email: [REDACTED, GDPR] governance_event: PRESERVED chain_hash: INTACT
Data Isolation
Three configurable levels of tenant isolation
Select the isolation tier appropriate to your compliance requirements, from database-enforced row-level security to complete physical separation.
Row-Level Security
All organizations share a single database schema, but native Row-Level Security policies ensure each organization can only see its own rows. The database query planner rewrites every query automatically, even application bugs cannot expose cross-organization data.
Schema-Per-Tenant
Dedicated database schema per organization with physically separate tables. Provides performance isolation, individual backup and restore capability, and can be configured per organization alongside Level 1.
Database-Per-Tenant
Complete physical separation with a dedicated database instance per organization, potentially on a dedicated server. Supports per-tenant connection pooling for maximum isolation.
Data Residency Enforcement
Each organization's required data region and compliance requirements are recorded and enforced. GDPR-flagged organizations are validated against regional routing rules. Built-in compliance views provide auditor-facing reports on data residency status.
Identity & Access
Defense-in-depth authentication
Dual Authentication Model
API Key Authentication
For programmatic and machine access. Keys are scoped to an organization with granular permission sets, validated via hash lookup, and support instant revocation with full audit trail.
User Session Authentication
For dashboard and UI access. Supports email/password, OAuth 2.0, and SAML 2.0 authentication with configurable session expiration and MFA verification state.
Single Sign-On
OAuth 2.0
Google, Microsoft, Okta, and Auth0 with automatic user provisioning and configurable default role assignment.
SAML 2.0
Any standards-compliant Identity Provider including Okta, Azure AD, PingFederate, and ADFS. Supports assertion validation, group-to-role mapping, Single Logout, and automatic user provisioning.
Multi-Factor Authentication
TOTP-based MFA compatible with Google Authenticator, Authy, 1Password, and any RFC 6238-compliant app. Enforcement is configurable: platform-wide, admin-only, or per user. Backup codes are provided at enrollment, individually hashed, and single-use. Sensitive operations can require MFA re-verification.
Role-Based Access Control
Granular permissions enforced on every protected endpoint. Built-in system roles for administrators, developers, viewers, and auditors, each carrying the minimum required permission set. Organizations can define custom roles with arbitrary permission combinations. All role assignment events are recorded in the audit log.
Application Security
Secure by construction
SQL Injection Prevention
100% of database queries across all supported adapters use parameterized queries with positional or named parameters. No string concatenation of user input into SQL, validated in the test suite.
Rate Limiting
Distributed rate limiting with support for both centralized (Redis-backed) and single-instance deployments. Applied at the controller level to prevent abuse and resource exhaustion.
Circuit Breakers
Outbound calls to downstream services are protected by circuit breakers. If a service degrades, the circuit opens automatically, preventing cascading failures and providing fast-fail responses.
Input Validation
All API request bodies are validated against strict schemas before reaching controllers. Invalid requests are rejected with structured error responses, no unvalidated input reaches business logic.
Error Handling
A global exception handler catches unhandled exceptions and returns normalized error responses. Sensitive information (stack traces, database details, internal paths) is never exposed in production.
Soft Deletes
Critical records use soft deletes to preserve audit trail integrity and foreign key relationships in log tables. This enables recovery from accidental deletions without touching immutable audit records.
Infrastructure
Hardened by default
Containerization
All services ship with production-ready container images designed for non-root execution. Docker Compose and Kubernetes manifests support secure environment variable injection.
Resource Limits
Database connection pools with configurable limits, idle timeout, and automatic cleanup prevent connection exhaustion and ensure predictable resource consumption.
Network Architecture
Internal AI services are accessible only from the Control Plane, never exposed to external networks. Only the Control Plane's HTTP endpoint is exposed, typically behind a reverse proxy handling TLS termination.
Disaster Recovery
- Daily full backups with hourly point-in-time recovery
- 7-year retention with tiered storage (hot → cold → archive)
- Offline air-gapped backups for ransomware protection
- Automated daily backup verification and quarterly DR simulations
Observability
Enterprise logging & SIEM integration
All logging routes through a pluggable backend selected at deployment time. Structured JSON with consistent fields (log level, timestamp, service, request ID, and organization context) ensures clean ingestion into any SIEM or monitoring pipeline.
stdout / stderr
Docker & Kubernetes log collection
Splunk HEC
Enterprise SIEM & SOC 2 compliance
Datadog
Cloud monitoring & APM
AWS CloudWatch
AWS-native deployments
Per-Request Governance Log
Every governance API call produces a log record with 40+ fields including identifiers, outcome, corrections, AI reasoning transparency, performance metrics, token usage, request metadata, and cryptographic chain fields. Designed for 7-year retention.
FAQ
Security & privacy, answered.
How does Trinitite protect customer data at rest?
Trinitite employs layered encryption for all sensitive data at rest. API keys are hashed using industry-standard algorithms and shown only once at creation. User passwords are hashed with bcrypt and automatic salting; plaintext passwords are never written to any storage layer or log. Session tokens, verification tokens, and MFA secrets are all cryptographically protected before storage. Every row carries organization-level scoping for complete data isolation.
Does Trinitite have access to customer data?
No. Trinitite is self-hosted by design. The entire platform runs inside the customer's own infrastructure. No Trinitite employee or system has access to customer data. There is no telemetry, no phone-home capability, and no external data egress. Customers control their own encryption keys, database, network policies, and backup schedule.
What compliance frameworks does Trinitite support?
Trinitite's security controls are designed to satisfy SOC 2 Type II, GDPR, HIPAA, and FedRAMP requirements. The platform includes immutable audit logs with cryptographic integrity verification, role-based access controls, multi-factor authentication, data residency enforcement, and right-to-erasure compatibility.
What is the cryptographic hash chain in Trinitite's audit logs?
Every governance decision produces a cryptographic State Tuple containing the full snapshot of the decision. Each entry is SHA-256 hashed and chained to the previous entry in a Merkle chain construction. This makes the audit trail mathematically tamper-evident. Modifying any single entry invalidates every subsequent chain hash, and the break is detectable by recomputing the chain.
Ready when you are
Ready to see it in action?
Schedule a security-focused walkthrough of the Trinitite platform. We'll show you the cryptographic audit trail, the immutable logs, and the defense-in-depth controls designed for your compliance requirements.