Security & Privacy Whitepaper

Trutina processes sensitive loan application documents to detect fraud. This document outlines our security architecture, data handling practices, and privacy commitments. We are designed for regulated financial institutions subject to APRA and Privacy Act 1988 requirements.

• Frontend: Hosted on Vercel (SOC 2 Type II, ISO 27001)
• Backend: Hosted on dedicated VPS in Sydney, Australia (data sovereignty)
• AI Engine: Anthropic Claude Sonnet (SOC 2 Type II compliant)
• Database: PostgreSQL with encryption at rest (AES-256)
• Jurisdiction: All data stays within Australian jurisdiction

1. Documents are uploaded via HTTPS (TLS 1.3)
2. Stored temporarily during analysis (~60 seconds active processing)
3. Text extracted from PDFs using PyMuPDF (local processing, no third-party OCR)
4. Document text sent to Anthropic Claude API for AI content analysis only
5. Raw PDF files are NOT sent to Claude — only extracted text

Critical for regulated customers:

• Anthropic's API Terms of Service explicitly state: “We do not train our models on your inputs or outputs”
• Anthropic is SOC 2 Type II certified
• Data sent to Claude API is processed and discarded — not stored, not used for training
• Trutina uses the Anthropic API (not consumer Claude) — business-grade data handling
• Source: anthropic.com/policies/privacy

• In transit: TLS 1.3 for all API communication
• At rest: AES-256 for database (PostgreSQL). Documents stored on encrypted filesystem.
• API keys: Hashed with bcrypt. Never stored in plaintext.
• Secrets management: Environment variables injected at deployment. No hardcoded credentials.

• API access: Per-customer API keys with rate limiting
• Dashboard: Password-based authentication with httpOnly secure cookies
• Future: SSO/SAML integration for Enterprise customers
• RBAC: Role-based access control planned for multi-user accounts

• Backend runs on dedicated infrastructure (not shared hosting)
• Firewall: Only ports 443 (HTTPS) and 22 (SSH management) exposed
• DDoS protection: Via Vercel's edge network (frontend)
• Rate limiting on all API endpoints
• IP allowlisting: Available for Enterprise customers

• Automated monitoring with alerting
• Security incidents communicated within 24 hours
• Post-incident review and report provided to affected customers
• Contact: security@trutina.com.au

• Trutina processes personal information (names, financial data) as a service provider
• Data Processing Agreement available for all customers
• We collect only what's necessary for fraud detection
• No data sold to third parties
• Individuals can request data deletion (right to erasure)
• Australian Privacy Principles (APPs) 1–13 addressed in full DPA

• Annual third-party penetration testing (report available under NDA)
• Continuous automated vulnerability scanning
• Dependency monitoring for known CVEs