Security and trust

Questions, or a security report: security@trellisexecution.com.

---

Where Trellis runs

• Application: Next.js, hosted on Vercel.
• Database: Postgres on Neon, in AWS us-east-2 (Ohio), United States.
• Files (documents attached to meetings, objectives and initiatives, and an imported file when you choose "keep a private copy"): Vercel Blob, in a private store. Files have no public address; every download goes through Trellis, is checked against your workspace, and is sent with headers that stop the browser running anything inside it.
• Sign-in and organization membership: Clerk. Each Clerk organization is one Trellis workspace.
• Email: Resend. AI features: Anthropic (see AI below).
• Today Trellis runs as a pilot. The live service uses one database shared with outside testers (on its own branch, separate from development) and Clerk's development instance. A separate production database and Clerk's production instance come with the production cutover, before paid customers.

Keeping companies apart

Trellis is multi-tenant: many companies' plans live in one database. The walls between them are built at three levels.

1. In the application. Every query is written to include your workspace, and every action that changes data first checks who you are and what you are allowed to change. A test reads the source of every action and fails the build if one skips that check.
2. In the database. 61 relationships between tables carry the workspace as part of the key, so the database itself refuses to link a record in one company to a record in another, even if the application asked it to.
3. An isolation exercise. A script creates two companies and tries six ways to cross between them (cross-company links, ownership, who gets notified, what each company's screens load, digests, and the app's own loaders given another company's records). It runs automatically every week against our development database, and a failure alerts us. It last passed on 2026-10-03.

Not yet built: Postgres row-level security, a fourth wall enforced inside the database for every query. It is planned with the database driver upgrade that is part of the production cutover.

The record cannot be quietly rewritten

• Measure readings are append-only. A correction is a new reading that points at the one it replaces; the original stays visible. The application has no way to edit or delete a past reading.
• Audit trail. Every change to the plan records who made it, what they changed, the value before and after, and when, written in the same transaction as the change itself, so one never lands without the other. Every download of the plan (the full JSON copy, the spreadsheets and the board pack) is recorded too, and so is an admin starting a preview of the app as another member. Reading the plan on screen is not logged. An automated check fails the build if a change to the plan stops being recorded.
• How this is enforced: by the application, which has no code path that edits or trims either history. The database does not yet independently forbid it.

Encryption

• In transit: TLS on every connection, with HTTP Strict Transport Security for a year, so browsers refuse an unencrypted connection.
• At rest: provided by Neon (database) and Vercel Blob (files), which encrypt stored data. Trellis does not add its own field-level encryption.
• Links that let someone post an update without signing in carry a random 256-bit token; only a fingerprint of it is stored, so a copy of the database cannot be used to forge one. Each link works once and expires.
• Phone notifications are encrypted to each device's own key before they leave Trellis.

Who can see and change what

• Two permission levels: Admin and Viewer. Admins manage the workspace and its people.
• Everything else comes from the work in your name. Owning an objective, initiative, milestone, measure or financial line, sitting on the leadership team, or running a meeting is what lets you update those records. Nobody types in what a person may change; it is read from the plan.
• Inside your company, an admin can preview the app exactly as another member sees it, to check what they can do. That preview cannot change anything as that person, and starting it is on the audit trail.
• At Trellis: there is no support login and no way for Trellis staff to sign in as you. One internal screen shows test-drive activity as counts only (how many trials, which steps were reached), with no names or plan content, and only to named Trellis addresses. The database can be reached by Trellis's founder through Neon's console, for restores and for deleting a workspace on request. That access is not yet recorded in a log; a record of operator access is planned with the production cutover.

AI

Trellis uses Anthropic's Claude models in three places. Each says when AI is involved, and nothing an AI produces lands on your plan until a person accepts it.

An admin can turn AI drafting off for the whole workspace, in the admin screen. Off, nothing from the plan is sent to Anthropic for summaries or drafts; meetings and updates work as before, without a draft. The change is recorded in the audit trail. Importing is separate: it asks before every upload.

Anthropic's commercial terms, checked 2026-10-03 on Anthropic's own pages:

• Anthropic does not train its models on data sent through its commercial API (Commercial Terms; Privacy Center).
• It deletes API inputs and outputs within 30 days, except where content is flagged under its usage policy (kept up to 2 years) or the law requires otherwise (retention).
• Its Data Processing Addendum is part of those terms, and it reports SOC 2 Type II and ISO 27001 certification (certifications).
• Where it is processed: in the United States. Anthropic stores API data in the US, and every request Trellis sends asks for US-only processing, so it is processed there too (data residency). An automated test fails if any call to Anthropic leaves that out.

In the test drive, AI import is switched off: a trial workspace cannot import its own documents until Trellis's terms, privacy policy and data processing addendum are published.

Backups and recovery

The database is on Neon, which keeps a history of changes and can restore a database to an earlier point. Trellis has a written restore procedure, and it was rehearsed on 2026-10-10: the development database was restored to a moment a few minutes earlier, and a change made after that moment was gone. Neon keeps 7 days of history, so the database can be restored to any moment in the past week.

Your data, and leaving

• You own your data. Trellis does not sell it and does not use it for anything but running your workspace.
• Export any time: an admin can download the whole plan as JSON, the plan and its full metric history as spreadsheets (CSV), the board pack as PowerPoint, and meetings as calendar files. Not yet available: files within the export (attachments are downloaded one by one), and the people list and audit trail within the self-serve export (both are included in the export prepared when a workspace is deleted).
• Deleting a workspace: on request, Trellis first exports everything (the plan, people, the audit trail) for you, then deletes every record and every stored file for that workspace, and confirms in writing. This is done by Trellis with a reviewed script, not yet by a button. Removing one person's data on their own request is handled by hand today.
• When a member leaves, their name stays on the readings, decisions and audit entries they made, because the record has to say who did what.

Other protections

• Pages cannot be embedded in another site, browsers are told not to guess file types, and the permissions the app can request from a browser are switched off except those it uses. A stricter content security policy is in place in monitoring mode, reporting what it would block, before it is enforced.
• Scheduled jobs (reminder emails, digests) require a secret to run. Incoming messages from Clerk are verified by signature, and refused if verification is not configured.
• Email reminders are never sent to addresses that are placeholders, or to people who are no longer members.

Subprocessors

When payments open, Stripe will handle billing and will receive billing contacts and payment details; Trellis never sees card numbers. Phone notifications pass through the browser maker's push service (Apple, Google or Mozilla) as encrypted messages those services cannot read.

Trust roadmap

Stated as plans, not promises of dates we have not set.

Version 3b83647, 2026-10-10.