Our Commitment to Responsible & Secure AI

Last updated: October 23, 2025

Introduction

‍

At Trustero, we believe that Artificial Intelligence should enhance human decision-making, strengthen security governance, and advance compliance maturity—never compromise them. We also recognize that Artificial Intelligence (AI) offers transformative potential for organizations. With this potential comes the responsibility to ensure that AI is used ethically, securely, and in compliance with regulatory standards. Our commitment is to integrate AI capabilities that enhance your Governance, Risk, and Compliance (GRC) operations while upholding the high standards of security and data protection.

‍

Our Principles

Security by Design

Our multi-agent AI solution is built with security as a foundational element. The platform implements multiple layers of protection to ensure that AI features enhance your operations without introducing new risks. We only use foundation models from trusted cloud providers through their official API channels. These providers are selected based on their enterprise-grade security capabilities and contractual protections of customer data that meet or exceed our own.

Data Privacy

Customer data protection is fundamental to our mission. Our AI systems are designed to assist with your operations while maintaining strict data privacy controls. We partner only with model providers that commit to zero data retention and strong encryption standards.

Transparency

Transparency earns trust—and accountability keeps it. We want our customers to understand how AI contributes to their insights and decisions. Every AI output within our system is traceable, explainable, and reviewable. We maintain detailed audit logs for prompts, responses, and orchestration chains.

Human Oversight and Control

Humans remain central to our process. All AI agents undergo rigorous testing and are reviewed and approved by experts before release. Our users maintain the ability to override, flag, or appeal AI-generated insights. We believe that AI should augment human judgment—not replace it.

Compliance

Our AI system is designed to support your Governance, Risk, and Compliance operations. We are committed to maintaining strong security certifications like SOC 2 and ISO 27001 as part of our trust posture. We continuously evaluate our practices against evolving regulatory standards for AI, security, and data protection. 

How We Use AI

Our multi-agent AI solution helps you manage your GRC operations more efficiently and effectively. These agents:

  • Collect and analyze the GRC artifacts (policies, controls, evidence, etc.), and internally organize them for proper contextualization
  • Interpret requests, create plans, distribute tasks, and complete them efficiently
  • Synthesize results, generate answers and reports (control evaluations, gap assessments, etc.), and finalize assigned tasks

All AI agents operate within our secure environment.

How We Protect Your Data

Use of Data

We never use your data to train AI models. Any content or documentation you store or create within our platform is strictly for your use and is not utilized to train, fine-tune, or improve the underlying foundational AI models. Your data is used only to provide tailored contextualization for your specific environment.

Multi-Tenant Protection

We keep each customer environment fully isolated. AI agents operate within this multi-tenant architecture, ensuring your data remains completely separate from other customers. The AI agent’s contextualization is limited exclusively to your own data.

Controlled Data Access

Our AI systems access your data exclusively through a secure middleware layer with strict permission controls. Data access is limited to what is necessary to deliver the service you subscribe to and is granted only to authorized personnel who support that service. We also employ strong access controls, including Role-Based Access Control (RBAC), least privilege,  and encryption (e.g. AES256). 

Data Deletion

Users can delete their data directly through the platform interface. Once deleted, the data is immediately removed from our production systems and is no longer accessible to other users or to us. When a customer terminates their account, we promptly remove their data from production. Secure cloud backups may retain deleted data for up to 100 days before permanent removal.

Continuous Monitoring and Improvement

We employ industry-leading security monitoring tools to detect unusual patterns or potential security issues. We evaluate our service providers on multiple dimensions, including security, and continuously seek opportunities to improve our systems, operations, and people.

Our Ongoing Commitment

We recognize that organizations need confidence in the security of our AI systems. We’re committed to transparency and welcome discussions with both prospective and existing customers. We view responsible and secure AI as an evolving discipline. Trustero will continue to refine our practices, engage with customers and regulators, and ensure our technology strengthens—never compromises—trust, governance, and compliance.

For more information about our AI security approach or to schedule a conversation with our security team, please contact security@trustero.com.