Security

Every product in the Triostack Business Suite inherits the same identity, access, and data-protection foundation from TriostackOne. This page describes Triostack's approach to security at a program level — how it is governed, how the platform and its applications are protected, and how to report a security concern.

Triostack maintains internal policies and assigns responsibility for security across engineering, operations, and leadership. Security expectations are reviewed periodically as the platform and its available applications evolve. Triostack does not currently represent that it holds a specific third-party security certification (such as SOC 2 or ISO 27001); see Trust Center for the current state of Triostack's compliance documentation.

TriostackOne runs on infrastructure designed with layered access controls and network segmentation intended to limit exposure of production systems. Specific hosting providers and data center locations are not listed publicly on this page; see Subprocessors for the categories of infrastructure providers involved once confirmed.

Application-level controls include authentication, role-based permissions, and input validation intended to reduce common web application risks. Security considerations are incorporated into how features are designed and reviewed, described further in Section 11.

TriostackOne provides a unified identity model and role-based permissions across the applications in the Business Suite, so a Customer can control what each User can see and do from a single place. Internally, Triostack applies the principle of least privilege to employee access to production systems and Customer Data, and reviews that access periodically.

Customer Data is logically separated by account and protected by the access controls described in this page and in the Privacy Policy. Data handling practices, including retention and deletion, are described on the Data Retention & Deletion page.

Triostack uses encryption to protect data in transit and, for stored data, at rest, using industry-standard approaches. This page does not name specific algorithms or key-management providers, which may change as the platform evolves; verified technical specifics can be provided under an appropriate confidentiality arrangement on request via Legal Contact.

Network-level controls, including segmentation and restricted administrative access, are used to limit exposure of internal systems and reduce the attack surface of production environments.

Triostack maintains logging and monitoring intended to help detect unusual activity across the platform. Retention of security and audit logs is described in the Data Retention & Deletion, Section 6.

Triostack works to identify and remediate vulnerabilities in the platform through a combination of internal review and the responsible disclosure process described in Section 17. Triostack does not currently represent that it operates a continuous third-party penetration-testing program; this page will be updated if that changes.

Security is considered throughout the development lifecycle, including code review and testing before changes are released to production. Access to source code and deployment systems is restricted to authorized personnel.

Triostack maintains backups intended to support recovery of Customer Data in the event of data loss, as described in the Data Retention & Deletion, Section 10. Backup retention and recovery are handled internally rather than by Customer self-service, unless a specific application offers export tools.

Triostack maintains an internal process for identifying, investigating, and responding to suspected security incidents. Where a Security Incident affects Customer Data, Triostack's notification approach is described in the Data Processing Agreement, Section 13.

Triostack maintains practices intended to support continued operation of the Services in the event of a disruption, including the backup practices described in Section 12. Standard service availability expectations are described in the Service Level Agreement.

Triostack personnel with access to production systems or Customer Data are subject to confidentiality obligations and access is granted based on role and need. Access is reviewed and removed when no longer required, such as on change of role or departure.

Triostack reviews subprocessors and other third-party service providers before engaging them for functions that involve Customer Data, and requires contractual data protection commitments consistent with the Data Processing Agreement. See Subprocessors.

Triostack welcomes good-faith reports from security researchers who believe they have found a vulnerability in TriostackOne. To report a suspected vulnerability, contact info@triostack.in or use Legal Contact, and include enough detail (affected URL or feature, steps to reproduce, and potential impact) for Triostack to investigate.

When researching a potential vulnerability, please:

• act in good faith and avoid privacy violations, service disruption, or destruction of data;
• do not access, modify, or exfiltrate data beyond what is necessary to demonstrate the issue;
• do not use social engineering, phishing, or physical attacks against Triostack personnel, Customers, or facilities;
• do not run automated scanning or testing that could degrade the Services for other Customers without prior authorization; and
• report the issue directly to Triostack rather than disclosing it publicly before it has been addressed.

For security questions that are not a vulnerability report, contact info@triostack.in or the full platform security overview at Platform Security.