Security & responsible disclosure
Every product in the Triostack Business Suite inherits the same identity, access, and data-protection foundation from TriostackOne. This guide summarizes what's relevant when you build on the platform, and how to report a security issue. The full policy is on the Security page under Legal.
1. Identity and access
TriostackOne provides a unified identity model and role-based permissions across every app, so a customer controls what each user can see and do from one place. Internally, Triostack applies the principle of least privilege to employee access to production systems and customer data, and reviews that access periodically.
2. Data protection and encryption
Customer data is logically separated by account. Triostack encrypts data in transit and, for stored data, at rest, using industry-standard approaches. Specific algorithms and key-management providers aren't named publicly; verified technical specifics can be provided under an appropriate confidentiality arrangement on request.
3. Monitoring, audit, and backups
Triostack maintains logging and monitoring to help detect unusual activity, and backups to support recovery of customer data. Backup and recovery are handled by Triostack; where an app offers export tools — such as CRM's Backup and Archive settings — customers can export their own data.
4. What this means for your integration
Your integration is part of your security perimeter. Store credentials server-side, give each integration the minimum permissions it needs, and review its activity in audit logs. Data your integration copies out of TriostackOne is no longer covered by TriostackOne's controls — protect it accordingly.
5. Reporting a vulnerability
Triostack welcomes good-faith reports from security researchers. Report a suspected vulnerability to info@triostack.in or through the Legal Contact page, with enough detail to investigate: the affected URL or feature, steps to reproduce, and the potential impact.
When researching, act in good faith and avoid privacy violations, service disruption, or destruction of data; don't access, modify, or exfiltrate data beyond what's needed to demonstrate the issue; don't use social engineering, phishing, or physical attacks; don't run automated scanning that could degrade the service for other customers without prior authorization; and report the issue to Triostack before disclosing it publicly.
Triostack doesn't currently run a paid bug bounty program and doesn't guarantee a specific response time.
Frequently asked questions
Does Triostack hold a security certification such as SOC 2 or ISO 27001?
Triostack does not currently represent that it holds a specific third-party security certification. See the Trust Center for the current state of compliance documentation.
Where is my data hosted?
Specific hosting providers and data center locations aren't listed publicly. See the Subprocessors page, which will list infrastructure providers once confirmed.
Who do I contact with a security question that isn't a vulnerability?
Email info@triostack.in, call +91-8882435276, or read the Platform Security overview.
How do I check whether TriostackOne is up?
Visit the Status page for live service status and incident history.