Website visits
No analytics, advertising, or tracking cookies on the marketing site. Your light or dark theme choice is stored only in your own browser. Our host keeps standard server logs.
Trust Center
We ask companies to trust us with their evidence. Here is how we earn it.
This page shows what TrustArk handles today, how we protect it, and where our own security program stands.We publish status honestly: if something is planned rather than done, it says so.
Last updated 25 October 2026
Where our own program stands
TrustArk is early. This is the honest state of our security program, updated as it changes.
| Area | Status | Detail |
|---|---|---|
| Information security policy libraryFourteen policies and fourteen supporting records are drafted. Owner approval, implementation evidence, and sign-off are under way. | In progress | Fourteen policies and fourteen supporting records are drafted. Owner approval, implementation evidence, and sign-off are under way. |
| Customer production dataTrustArk does not process customer production data today. Design-partner work starts with descriptions of a workflow, not sensitive records. | Planned | TrustArk does not process customer production data today. Design-partner work starts with descriptions of a workflow, not sensitive records. |
| Independent assurance (SOC 2, ISO/IEC 27001)Preparation is under way. No report or certificate has been issued yet; we will publish scope and timing here before we claim one. | In progress | Preparation is under way. No report or certificate has been issued yet; we will publish scope and timing here before we claim one. |
| Vulnerability disclosureSecurity reports are accepted by email and acknowledged by a person. See security.txt and our disclosure page. | In place | Security reports are accepted by email and acknowledged by a person. See security.txt and our disclosure page. |
What we handle today
Everything TrustArk currently collects, and why. The privacy notice has the full detail.
Design-partner and contact forms
Name, work email, company, and anything you choose to tell us. Forms are delivered through Formspree. We ask you not to send sensitive evidence or personal records.
Shared document links
When we send you a document link, opening it records the time, IP address, and browser so we know it arrived. If you identify yourself, a cookie remembers that on your device.
How the product is designed
The rules we build TrustArk around, so the evidence you rely on stays accountable.
People approve, software prepares
Digital workers draft and check. A named, accountable person signs off on every claim before it leaves your organization.
Bounded workers with stopping conditions
Each worker has a defined job and stops when evidence is missing, stale, or out of scope, instead of guessing.
Every claim traces to its source
Evidence keeps its origin, owner, freshness, and review history, so you can show why an answer was given.
Unknowns stay visible
Gaps and exceptions are recorded as open work, not hidden behind a green checkmark.
Security policies
Our policy library covers fourteen areas. These are drafts being implemented; full documents are available to design partners on request.
Sub-processors
Third parties that handle information on our behalf today. We will update this list before the product processes customer data.
| Provider | Purpose | Location |
|---|---|---|
| Bluehost (Newfold Digital) | Website hosting and server logs | United States |
| Formspree | Delivery of website form submissions | United States |
| Google (Google Workspace) | Company email and correspondence | United States |
Report a vulnerability
If you believe you have found a security issue in anything TrustArk operates, please tell us.
Email security@trustark.io with the subject “Security”, a description, and steps to reproduce. A person will acknowledge your report.
Please act in good faith: do not access or change data that is not yours, do not degrade the service, and give us reasonable time to fix the issue before telling others.
Machine-readable contact details are at /.well-known/security.txt. Read the full disclosure policy.