Privacy policy

Effective October 16, 2026

TrustCero provides software that companies install on their computers to record which websites and online services those computers connect to, and to enforce the company's web access rules. This policy explains what personal data we handle, why, and the choices you have. Questions go to privacy@trustcero.com.

1. Who is responsible for your data

TrustCero acts in two different roles, depending on the data:

For our customers' administrators and visitors to this website, TrustCero decides how the data is used and is responsible for it (a "controller" under laws such as Brazil's LGPD and Canada's privacy laws).
For data collected from computers our customers manage, including data about their employees, the customer (usually the employer) decides what is collected and why. TrustCero processes that data only on the customer's instructions (a "processor" or "service provider"). Section 9 explains what this means for employees.

2. What we collect

Console administrators

Your name, work email address, and the company account you belong to.
Your password, stored only as a salted one-way hash (we cannot see it).
The secret for your two-factor authentication app, used to check your sign-in codes.
A record of sign-ins and actions you take in the console, with the time and IP address. This audit log is part of the security features our customers rely on.

Computers running the TrustCero agent

Device details: computer name, operating system, agent version, and a device key used to authenticate the agent.
Agent health: whether the agent is running, which version of the company's rules it has, and signs that the agent was tampered with.
Connection details: for each connection the computer makes, the website or service name (for example, dropbox.com), destination IP address and port, time, duration, amount of data sent and received, the application and signed-in user that made it, and whether the company's rules allowed or blocked it.

Visitors to this website

This website does not use analytics or advertising trackers. Our hosting provider processes standard technical data, such as IP addresses, to deliver pages and protect against abuse. If you email us, we keep your message to reply.

3. What we do not collect

TrustCero records which sites and services a computer connects to, not what happens there. We do not collect the content of web pages, the full address of the pages visited (only the site name), messages, emails, files, form entries, passwords, keystrokes, screenshots, or the content of encrypted connections. We do not offer any feature to decrypt or inspect encrypted traffic.

If we ever offer content inspection, it will be off by default, enabled only by a customer for specific categories, and shown to the person using the computer. We will update this policy before it is available.

4. How we use data

To provide the service: showing customers which computers are protected, enforcing their rules, and keeping the records they ask for.
To secure the service: authenticating administrators and devices, detecting tampering, and investigating abuse.
To support customers when they contact us.
To meet legal obligations.

We do not sell personal data, share it for advertising, or use data from customers' computers to build profiles or train models for other purposes.

5. Sign in with Google or Microsoft

If you sign in to the console with a Google or Microsoft account, we receive your name, email address, and a unique account identifier from that provider. We use them only to sign you in and to show who made changes in the audit log. We do not request access to your email, files, calendar, or contacts.

TrustCero's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We share personal data only with:

The customer that controls it. A company's administrators see data from that company's computers, and no other company's.
Service providers that run parts of our service under contracts that limit their use of the data:

Provider	Purpose	Location
Cloudflare, Inc.	Website hosting, domain name service, email forwarding	Global network
Amazon Web Services, Inc.	Cryptographic key management for signing customer rules	United States
Google LLC, Microsoft Corporation	Sign-in, only if you choose to sign in with them	United States

We will list the provider that hosts the console and its database here before the console is generally available, and notify customers before adding new providers that process their data.

Legal requirements. We disclose data if required by law. Where we lawfully can, we notify the affected customer first.
Business transfers. If TrustCero is acquired or merged, data may transfer to the new owner under this policy's protections.

7. How long we keep data

Connection details: 90 days by default. Customers can choose a different period, and can preserve specific records longer for legal reasons.
Console audit log: for the life of the customer's account, because customers rely on it for security and compliance.
Administrator accounts: while the account is active.

When a customer closes their account, we delete their data, except where we must keep it for legal reasons. Contact privacy@trustcero.com to arrange deletion.

8. How we protect data

Every company's data is kept separate by rules enforced in the database itself, not only in our application code.
Two-factor authentication is required for every console administrator.
The rules sent to computers are digitally signed with a key held in a hardware-backed key service, and the agent rejects anything not signed by it.
Agents authenticate with a key unique to each computer. There are no shared passwords between devices.
Data is encrypted in transit.

No system is perfectly secure. If a breach affects your personal data, we will notify the affected customers and, where the law requires, regulators and individuals, within the time the law requires.

9. If your employer uses TrustCero

If your employer installed TrustCero on a computer you use, your employer controls what is collected and decides how it is used. Many laws require employers to tell employees about this kind of monitoring, and some require written acknowledgment. Your employer is responsible for meeting those requirements, and your employer's own policy governs how they use the data.

To access, correct, or delete data collected from your work computer, contact your employer. If you contact us, we will forward your request to them.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict how it is used, and to withdraw consent where we rely on it. This includes rights under Brazil's LGPD, Canada's PIPEDA and Quebec's Law 25, and US state privacy laws.

To use these rights for data we control, email privacy@trustcero.com. We will verify your identity and respond within the time the law requires. For data collected by your employer, see section 9. You can also complain to your local data protection authority, such as Brazil's ANPD.

11. Where data is stored

We store data in the United States. If you are outside the United States, your data is transferred there. Where the law requires, we protect those transfers with contractual safeguards, such as standard contractual clauses.

12. Cookies

This website sets no cookies. The console uses one cookie, which keeps you signed in and protects against forged requests. It is strictly necessary and is not used for tracking.

13. Children

TrustCero is a business service and is not directed to children. We do not knowingly collect data from children under 16.

14. Changes to this policy

We will post changes on this page and update the effective date. If a change materially affects how we handle customer data, we will notify customers before it takes effect.

15. Contact us

Email privacy@trustcero.com for privacy questions or requests, and support@trustcero.com for everything else.