Security
Different data, different rules.
Trustwelt handles several kinds of data. Each has its own storage, its own encryption and its own deletion path. None of them borrows another's promises.
Data classes
What we hold, and why.
Four kinds of data, kept apart.
| Data class | What it is | Where it lives | Who can read it |
|---|---|---|---|
| Sealed vault data | Sync envelopes, collection items and activity records, encrypted on the person's computer before they leave it | The sync service, wrapped a second time at rest with a per-vault key | Only the person's own computers, or the member computers of a collection. Trustwelt cannot open it. |
| Customer security data | Devices, posture results, trust decisions, incidents, usage events, web protection records (a blocked or warned site: which site, when, which rule, which computer — never a page's content) and audit records of your organisation | Trustwelt's database, scoped to your organisation | Your organisation, through its admin console, within the permissions of each admin |
| Control plane state | Accounts, memberships, sessions, policy, plans and subscriptions, and the site and username of company logins | Trustwelt's database | The service, to run it. A session is valid for one surface only. |
| Operational data | Request logs and metrics used to run and protect the service, without query strings or bodies | Trustwelt's operational systems, kept separate from audit records | Trustwelt operations staff, on a need-to-know basis |
Your secrets
Passwords are not in our cloud.
- Passwords, one-time code secrets and card numbers live in the encrypted vault on your own computer.
- The key comes from your master password on that computer. Trustwelt never receives it and cannot decrypt your vault, its sync envelopes or your activity record.
- The Portal and admin consoles show a site and a username at most, never the password, and never decrypt a vault item.
- Trustwelt holds no recovery key for your vault. You can print your own recovery kit; without it or your master password, nobody can open your vault, including us.
- Card security codes are never stored at all, anywhere.
- Your personal activity stays yours. Your employer does not see how you use your personal passwords and cards, even on a computer they manage; an organisation sees counts at most.
Encryption and keys
Keys are separated by purpose.
| Key class | Used for | Custody |
|---|---|---|
| Vault data | Your vault, its sync envelopes and your activity record | Only on your device, derived from your master password. Trustwelt cannot decrypt it. |
| Collection keys | Items shared with a family, a team or a custodian scope | Wrapped for each member computer's key, held in that computer's key store. Rotated when a member leaves. |
| Second wrap at rest | Every sealed envelope stored by the sync service | A per-vault data key under Trustwelt's key hierarchy, separate from the customer's keys. |
All traffic to Trustwelt is encrypted in transit with TLS 1.2 or 1.3. Enrolled devices sign every request with their own key.
Retention, deletion, residency
How long we keep it, and where.
- Where. Your data is stored in Europe. The region is named in your agreement.
- Usage records of company items follow a retention your organisation sets, a year by default for logins and one-time codes. Card records stay for the life of the card.
- Sealed vault data is removed when you delete the vault's sync space or your account, and a card's copy when you withdraw your consent for it.
- Accounts and organisations are deleted on request, with their memberships, devices, sessions and sync spaces. Audit records of an organisation are kept as long as the organisation asks, then deleted with it.
- Payment records are kept for as long as accounting and tax law require, and are never deleted before that.
- Backups are encrypted, kept apart from the live data, and expire on a fixed schedule, so a deletion also reaches the backups in time.
This website
The website collects almost nothing.
trustwelt.com sets one essential cookie, to remember your privacy choice, and runs no analytics. The contact form sends only what you type to our contact service. Details are in the privacy notice.