Product
What Trustwelt does, and how far along each part is.
One table per area: the capability, where it runs, and its status today. The same list drives our roadmap; nothing here is shorthand for something that does not exist yet.
How to read the tables
One status per capability.
- AvailableIn the product today, on the current plans.
- Early accessBuilt and in use with early customers; details may still change.
- RoadmapDesigned and scheduled, not yet shipped.
- ProgrammePart of the programme, not yet designed in detail.
Capabilities
Your secrets, on your computer
Trustwelt Desktop keeps a person's own logins, codes, notes and cards in one encrypted file whose key never leaves the device.
| Capability | Where | Status |
|---|---|---|
| Encrypted local vault (Argon2id, XChaCha20-Poly1305)Open source; works without an account. | Desktop | Available |
| Logins with autofill on the site you are onOnly a login whose address matches the page is offered. | Desktop, Extension | Available |
| One-time codes (TOTP) next to the loginThe code is filled into the site's code field; QR, otpauth link or authenticator-app transfer import. | Desktop, Extension | Available |
| Passkeys in Trustwelt Desktop, offered by Windows and macOSThrough the operating system's passkey window, never through the page; the private key stays in the vault service. | Desktop | Roadmap |
| One way only: no web page can reach the extensionThe extension reads and fills the page; nothing in the page can message it or detect a script of it. | Extension | Available |
| Secure notes with formatting and coloursA note can also be shown in the Portal, encrypted, when the person chooses. | Desktop, Portal | Available |
| Payment cards without the security codeThe CVV is never stored; the number is shown only after the master password. | Desktop, Extension | Available |
| An overview of everything the vault holdsThe first screen after unlock: logins and passkeys, payments, contact info, identity documents, travel and notes, with counts. | Desktop | Early access |
| Addresses filled into shop and sign-up formsRecognised in English, Turkish, German and French forms; filled only when you choose, never into a password or card field. | Desktop, Extension | Early access |
| IBANs and loyalty cardsAn IBAN is checked when saved and hidden until shown; the country code is left out where the page prints it. | Desktop, Extension | Early access |
| Passports, identity cards and driver's licencesThe numbers only, never a photo or a scan; every fill in a browser is confirmed in Trustwelt Desktop; expiry is pointed out. | Desktop, Extension | Early access |
| Travel numbers and vehiclesKnown-traveller, redress and frequent-flyer numbers; number plate, VIN, make and model. | Desktop, Extension | Early access |
| Strong passwords on sign-up forms and Trustwelt's own save barTrustwelt, not the browser, offers to save. | Extension | Available |
| Import logins and cards from Chrome, Edge and BraveBrowser copies are removed only with the person's separate consent. | Desktop | Available |
| End-to-end encrypted sync between your computersOnly ciphertext reaches Trustwelt; the key never does. | Desktop, Portal | Available |
| Shared collections for a familyOn the Family plan. | Desktop, Portal | Roadmap |
| Family plan: an organiser, up to five people, children, web protection includedThe family, its people and children, and its site rules run from the Portal, and every member's computer takes the family's rules. Binding a child's own computer follows. Two computers per person; a sixth person costs 1 $ a month. | Portal, Desktop | Early access |
| Your own web rules on StandardBlock, warn about or always allow the sites you choose; in force on every computer where you use Trustwelt Desktop as soon as you save them in the Portal, with your own block page. A family's or an organisation's rules take their place on the computers they protect. | Portal, Desktop | Early access |
| Confirmation on use and a quick PINA PIN or the master password before a fill, per the person's setting. | Desktop | Available |
Capabilities
Your account and sign-in
The Portal is the person's account: devices, sessions, two-step sign-in and the things an organisation shares with them.
| Capability | Where | Status |
|---|---|---|
| Two-step sign-in with an authenticator appGoogle Authenticator, Microsoft Authenticator, Oracle Mobile Authenticator or any TOTP app. | Portal | Available |
| Security keys and passkeys for the PortalWebAuthn with the deployment's domain as relying party. | Portal | Early access |
| Recovery codesShown once, stored offline by the person. | Portal | Available |
| Devices and sessions in one place, with revocationEach computer that can open the vault, and each browser signed in. | Portal | Available |
| Desktop sign-in with a device-bound token (OAuth PKCE)The desktop never sees the Portal password. | Desktop, Portal | Available |
| One place to sign in: personal Portal or the organisation's own addressAn organisation's people sign in at its own address, such as acme.trustwelt.com, and nowhere else. | Portal | Available |
| Two-step codes handed from the Portal to the desktopSealed in the browser to the person's own desktops; the server holds ciphertext for seven days. | Portal, Desktop | Available |
| Browser sign-in inventory (site and username, never the password)Uploaded only with the person's consent. | Portal, Desktop | Available |
Capabilities
Organisations
Tenant Admin runs the organisation. Company logins and cards are used, never seen; every use is in the audit.
| Capability | Where | Status |
|---|---|---|
| Company logins used by people and teams, never shownA one-time permission per fill; the secret is never on screen. | Organisation, Desktop | Available |
| Company cards held by finance, paid with but never readEvery payment in the usage audit with its amount. | Organisation, Desktop | Available |
| Access requests, approvals and delegated sharingRequest, approve, deny; share the use, not the password. | Organisation, Portal | Available |
| Credential categories and the role ceiling matrixWhat each role may hold, by category. | Organisation | Available |
| Custodian scopes (sealed areas with break-glass)Finance, HR, IT and your own areas, each with its custodians. | Organisation | Available |
| Delegated admin areas and invitations by e-mailHR invites; people join with their own account. | Organisation | Available |
| Usage audit and CSV exportWho used which company item, when, from which computer. | Organisation, Portal | Available |
| Policy-based deployment of the extension (Chrome, Edge, Firefox)Store distribution plus enterprise policy; the Firefox build awaits store signing. | Organisation | Early access |
Capabilities
Device trust
Enrolled computers with their own cryptographic identity, posture signals, and decisions made on the server.
| Capability | Where | Status |
|---|---|---|
| Managed computers: set up once, always on, nothing for the person to doThe person types their master password once; no Quit or Sign out; the organisation is told when a computer stops reporting. Linux first; Windows and macOS follow. | Organisation, Desktop | Early access |
| Device enrolment with single-use tokens and mTLS identityEach device holds its own certificate. | Organisation, Agent | Available |
| Posture signals (OS, disk encryption, firewall, extension state)Typed signals, not free text. | Agent | Early access |
| Trust decisions and signed policyThe server decides; the device reports. | Platform, Organisation | Early access |
| Allowlisted remediation instead of a remote shellRegistered, signed actions only. | Organisation, Agent | Early access |
| OS and patch baseline evaluation from signed bundlesReference data arrives offline as a signed bundle. | Agent | Roadmap |
Capabilities
Credential and threat intelligence
Detection runs locally. Reference data comes as signed bundles, so it works the same when the deployment is offline.
| Capability | Where | Status |
|---|---|---|
| Weak and reused password detectionComputed on the device from the vault. | Desktop | Early access |
| Compromised password detectionLocal matching against a signed breach bundle; no password leaves the device. | Desktop | Roadmap |
| Web protection: site rules, block page, warnings, activity recordRules the organisation writes and publishes; applied on the computer; a blocked site shows the organisation's page. | Organisation, Desktop, Extension | Available |
| Web protection on every browser and application of a managed computerThe computer itself applies the rules by a site's name, decrypting nothing; a blocked site still shows the organisation's page. Linux first; Windows and macOS follow. | Desktop | Early access |
| Private windows allowed or not, the organisation's choiceAllowed by default; site blocks hold in a private window either way. | Organisation, Desktop | Available |
| Certificate check on sites being visitedAn expired, forged or untrusted certificate stops the site with the reason shown. | Desktop, Extension | Available |
| Phishing domain feedA signed reputation bundle feeding the same rules; optional live lookup only where the customer allows it. | Organisation | Roadmap |
| Shadow SaaS and shadow AI discoveryFrom signed catalogues of services, matched locally. | Agent, Organisation | Roadmap |
| Credential risk scoringWeak, reused, breached and unmanaged, in one score. | Organisation | Roadmap |
Capabilities
Secrets, workloads and privileged access
The same identity model for machines and AI agents, and for the accounts that run production.
| Capability | Where | Status |
|---|---|---|
| Secrets for applications and CI, with short leasesStored, dynamic and brokered. | Platform | Programme |
| Workload and AI agent identityAgents with an owner, tool permissions and a maximum lease. | Platform | Programme |
| Privileged access: JIT, JEA, session brokering, Zero Standing PrivilegeRecordings kept in the customer's own storage. | Platform | Programme |
| CLI and SSH agentDeveloper tooling on the same vault. | Desktop | Roadmap |
Deployment models
SaaS, Hybrid or entirely on your premises.
Three ways to run the same product. The security model, the code and the capability list do not change between them; what changes is who runs the platform and where the data lives.
| Trustwelt SaaS | Enterprise Hybrid | Enterprise On-Prem | |
|---|---|---|---|
| Who runs the platform | Trustwelt | Trustwelt and you | You |
| Trustwelt SaaS needed at runtime | Yes | Yes | Never |
| Identity, MFA, passkeys, policy, vault, audit | Trustwelt-hosted | Split by agreement | Inside your network |
| Data residency | UK and EU regions | Per component | Entirely yours |
| Your identity provider (AD, LDAP, OIDC, SAML) | Federated | Federated | Authoritative or federated |
| Your HSM or KMS | – | Optional | Software, HSM, KMS or PKCS#11 |
| Updates | Continuous | Scheduled | Connected, scheduled or offline bundles |
| Licence check at runtime | Account | Account | Signed file, offline; expiry never locks people out |
| Availability | Available | On request | Roadmap |
The on-prem rule
Everything required to operate Trustwelt exists inside your environment. If Trustwelt's cloud and the public Internet do not exist from the deployment's point of view, people still sign in, open their vaults, use their passkeys and codes, policy is still evaluated and the audit still runs.Connectivity profiles
Connected, Restricted or Air-Gapped.
An on-prem deployment chooses how much it talks to the outside world. Runtime capabilities are local in all three; only update and intelligence delivery differ.
| Connected | Restricted | Air-Gapped | |
|---|---|---|---|
| Internet or Trustwelt reachable | Yes, for optional functions | Only through your proxy or sync window | No |
| Login, vault, passkeys, codes, policy, audit | Local | Local | Local |
| Phishing, breach, SaaS and AI intelligence | Fresh by automatic bundle | Fresh as of the last sync window | Fresh as of the last imported bundle |
| Live reputation lookups | Optional, you enable them | Optional, you enable them | Not available |
| Software updates and licences | Pulled through your relay | Pulled in the window | Imported as signed files |
| Browser extension and endpoint agent | Store or policy | Policy from your repository | Signed packages from your repository |
Questions
Common questions about capabilities and deployment.
- What do "Available", "Early access", "Roadmap" and "Programme" mean on this page?
- Available is in the product today on the current plans. Early access is built and used with early customers, so details may still change. Roadmap is designed and scheduled but not shipped. Programme is part of the programme and not yet designed in detail. We keep one status per capability and this page never promotes one beyond the engineering record.
- Can Trustwelt run entirely inside our own network?
- That is Trustwelt Enterprise On-Prem: every required function (identity, MFA, passkeys, policy, vault, secrets, audit and administration) runs in your infrastructure, and Trustwelt's cloud is never a runtime dependency. It is on the roadmap, with the same codebase as the SaaS. Enterprise Hybrid, where some components run with you and the SaaS stays part of the runtime, is available on request.
- What happens to phishing or breach detection when a deployment is air-gapped?
- The detection runs locally in every deployment. Only the reference data differs: in an air-gapped deployment it comes from signed bundles you import, so a newly published breach or phishing domain is detected after the next import rather than within minutes. Login, vault, codes, policy and audit never depend on that data.
- Which authenticator apps work for two-step sign-in?
- Any app that generates time-based one-time codes (TOTP): Google Authenticator, Microsoft Authenticator, Oracle Mobile Authenticator, Authy, 1Password and others. You scan a QR code once on the Portal's Security page; the same code can also be kept in Trustwelt Desktop.
- Is the capability list the same on every plan?
- Security capabilities are the same on every plan: encryption, two-step sign-in, device identity, revocation and your own audit record. Paid plans add sync, sharing, organisation features and more connected computers. Pricing has the plan comparison.
Tell us what you need to run, and where.
We will map your requirements onto this list and say plainly what is available, in early access, or on the roadmap.