Trust and security

What you can count on

• Your contacts are yours. Cancel anytime, export everything in one click.
• We never use your data to train AI for other agents.
• We never sell your data, and we never compete with you using your relationships.

Where your data lives

Your workspace data is stored in Australia. Our database and file storage run on Supabase in its Sydney region. That is where your contacts, conversations, documents, and uploaded files sit. The Portal and the API run on Vercel in its Sydney region.

Some processing happens outside Australia. When Trix uses a model to draft or reason over your text, or to build the embeddings behind search, that text is sent to OpenAI, which operates outside Australia. The supporting services listed below each handle the specific data they need to do their job.

Who we rely on

We use a small set of established providers to run Trivexis. Each one processes only the data it needs for its part of the service.

How Trix uses your data

Trix uses OpenAI models to draft, reason, and search. We do not fine-tune or train any model on your data. Our AI gateway is restricted to OpenAI and requires a route that does not use prompts for model training. OpenAI does not use API inputs or outputs to train its models by default. These no-training controls are separate from provider retention and abuse-monitoring periods; the model's output comes back to your workspace.

Your workspace is isolated. Every record is scoped to your organisation and protected by row-level security, so your voice and history shape your drafts alone, never another agency's.

Security practices

AI training controls

Trix sends model requests to OpenAI through Vercel AI Gateway with OpenAI-only routing and prompt-training disabled for Gateway-managed credentials. If bring-your-own provider credentials are enabled, that Gateway filter does not apply; OpenAI account-level business/API controls must be configured and verified separately.

Tenant isolation

Every record is scoped to your organisation and protected by row-level security in the database. One agency's data cannot be read while we serve another.

Encrypted connections

Traffic between your browser, our services, and our providers uses HTTPS.

Verified webhooks

Billing events from Stripe and identity events from WorkOS are checked against a signing secret before we act on them, and rejected when the signature does not match.

Single sign-on

Sign-in, sessions, and organisation membership run through WorkOS AuthKit.

Redacted logging

Our logs record stable identifiers and redact secrets and personal information.

Independent testing and certification

We have not yet completed independent penetration testing or a formal certification such as SOC 2 or ISO 27001. When that changes, this page will say so. We would rather tell you the current state than imply a badge we do not hold.

If there is a data breach

If we detect a breach of your data that is likely to cause serious harm, we assess it and notify the affected individuals and the Office of the Australian Information Commissioner, in line with the Notifiable Data Breaches scheme under the Privacy Act 1988. We also tell the agencies whose data is involved, so they can meet their own obligations to the people in their books.

You can check whether Trivexis is running normally at status.trivexis.com.au.

Contact

For security or privacy questions, email paul.catamio@trivexis.com.au. You can also read our privacy policy.