Privacy for vendor governance workflows.

This Privacy Policy describes how Truvern handles personal information in connection with its websites, customer accounts, vendor assessment workflows, evidence workflows, communications, governance operations, and related services.

Where Truvern processes personal information on behalf of a customer, the customer may determine the purposes of that processing and additional terms may apply through the Data Processing Addendum or another written agreement.

The information Truvern handles depends on how the service is used.

• Account and profile information, such as names, business email addresses, roles, organization information, and authentication identifiers.
• Vendor information, including vendor names, contacts, ownership information, risk context, and relationship details supplied by customers or vendors.
• Assessment information, including questionnaire responses, scores, comments, review decisions, findings, remediation information, and attestations.
• Evidence and documents uploaded or submitted in support of assessments, remediation, or governance decisions.
• Communications data associated with vendor outreach, review operations, notifications, and support.
• Operational metadata, including timestamps, workflow states, audit records, security events, and technical information needed to operate and protect the service.
• Billing and transaction information associated with subscriptions, credits, and purchases. Payment card processing may be performed by a payment provider rather than stored directly by Truvern.

Truvern uses information to provide, secure, maintain, support, and improve the services requested by customers and vendors.

• Operate vendor intake, assessment, evidence, review, remediation, attestation, and governance-release workflows.
• Authenticate users and enforce organization, role, and access controls.
• Send assessment requests, operational messages, notifications, and service communications.
• Generate and maintain governance records, reports, review history, audit trails, and verification artifacts.
• Process subscriptions, credits, billing, and related commercial transactions.
• Detect abuse, investigate incidents, troubleshoot failures, and protect platform integrity.
• Comply with legal obligations and enforce applicable agreements.

Customers determine which vendors to assess and which information to submit through their governance workflows. Customers are responsible for ensuring that they have an appropriate basis to provide vendor contacts, documents, evidence, and other information to Truvern.

Vendors may also provide assessment responses and evidence directly through secure vendor workflows. That information is used in connection with the applicable customer's review and governance process.

Truvern does not disclose customer or vendor information except as needed to provide the service, follow customer instructions, protect the platform, complete a transaction, comply with law, or support a corporate transaction.

Information may be shared with infrastructure and service providers that process information for Truvern under applicable contractual arrangements. Current provider categories are described on the Subprocessors page.

Truvern uses administrative, technical, and organizational measures designed to protect information against unauthorized access, alteration, loss, or disclosure.

Security controls include access restrictions and technical safeguards appropriate to the service architecture. No system can guarantee absolute security, and customers should use appropriate controls when deciding what information to submit.

Truvern retains information for as long as reasonably necessary to provide the service, maintain governance and audit records, satisfy contractual requirements, resolve disputes, protect the platform, and comply with applicable law.

Retention may vary by data type, customer configuration, workflow state, contractual requirement, and legal obligation. Some information may remain in backups or immutable governance records for a limited period or as required by an applicable agreement.

Truvern may use cookies or similar technologies that are necessary for authentication, security, session management, preferences, and operation of the website and platform. Additional information may be provided through Truvern's cookie notice.

Depending on your location and applicable law, you may have rights to request access, correction, deletion, restriction, portability, or other action concerning personal information.

Some information is controlled by a Truvern customer. In those circumstances, Truvern may direct a request to the relevant customer or assist the customer in responding as appropriate.

Requests may be submitted through the Truvern contact page. Truvern may need to verify identity and authority before completing a request.

Truvern and its service providers may process information in locations different from the location of the customer or individual. Where applicable law requires a transfer mechanism or additional safeguards, Truvern will use measures intended to support the required transfer.

Truvern is a business governance service and is not directed to children. Customers and vendors should not intentionally submit children's personal information unless it is necessary, lawful, and specifically appropriate for the relevant business process.

Truvern may update this Privacy Policy as the service, legal requirements, or privacy practices evolve. Material revisions will be reflected on this page with an updated effective date.

Privacy questions and requests may be submitted through the Truvern contact page. Security-related reports may be directed to security@truvern.com.