Honest status, not a wish-list. ‘Roadmap’ means planned, not present; ‘to be confirmed’ means we’ll answer it precisely during onboarding rather than guess here.
AvailableSecurity contact
Reach the team directly for any security question or concern:
hello@trusq.io.
NamedWho's behind Trusq
Trusq is a product of YRproject B.V. — meet the founder and read why Trusq exists on the
About page.
PublishedResponsible disclosure
In placeSecurity posture
All traffic over HTTPS/TLS with HSTS and a Content-Security-Policy that confines resources to our own origin and a named EU analytics host (object-src 'none', framing restricted; inline scripts/styles are still permitted pending a hash migration); passwords hashed with salted PBKDF2; automated daily backups with an off-site copy. Detail in the
security questionnaire.
PublishedEU sub-processors
Every provider is EU-based, listed with role, location and purpose on the
sub-processors page. No US sub-processors.
European Union onlyData residency
All data is processed and hosted in the EU (hosting in Germany and France).
European Union onlyAI processing location
Customer content is processed by our EU AI provider in France — never by US AI services.
EnabledEncryption in transit
All traffic is served over HTTPS/TLS with HSTS. Encryption-at-rest specifics are confirmed during onboarding.
During onboardingData Processing Agreement
Trusq is processor, your organisation is controller. A DPA is provided for signature during onboarding, before production use; the sub-processor list is public.
See sub-processors.
Self-serveVendor due-diligence answers
The questions security, legal and procurement teams ask — answered in one place, including what isn’t ready yet:
security questionnaire.
On the roadmapSSO / SAML
Not yet available. Prioritised for enterprise onboarding; tell us if you need it and we’ll factor it into sequencing.
No SLA yetSLA & uptime
No contractual uptime guarantee today, and no automated uptime history. Current posture is on the
status page; a formal SLA is on the roadmap.
To be confirmedIndependent audit / pentest
No third-party security audit or penetration test has been completed yet. We’ll publish scope and outcome here once one has.
Not certified — roadmapISO 27001
We are aligning our controls toward ISO 27001. Not yet certified — we will not claim a certificate we don’t hold.
Under evaluationISO 42001 (AI management)
We are evaluating ISO 42001 for our AI layer. Not yet certified.
Data Processing Agreement
For personal data you process through Trusq, your organisation is the
controller and Trusq (YRproject B.V.) is the
processor. A GDPR Art. 28 Data Processing Agreement is provided for signature
during onboarding, before any production use. Our sub-processor list is public (below), so your legal team can review who is involved up front. Ask us at
privacy@trusq.io.