Data intake
Do not email confidential customer records or site telemetry for preliminary quotations. Trusta will confirm identity, permitted purpose, data rights and a suitable secure intake method before accepting protected files.
Contracts and retention
Any data-processing terms, authorized subprocessors, retention and deletion commitments, service scope, acceptance criteria and payment/refund arrangements must be agreed for the actual engagement.
Operational controls
Readiness should be evidenced through appropriate access boundaries, source reviews, test records, backup/restore verification and incident-handling controls. Public app availability is not proof of complete recovery readiness.
Assurance status
Trusta does not claim SOC 2 certification, ISO certification, accredited testing, enterprise compliance approval or an external security audit without documentation applicable to the specific service.
Procurement teams may request an evidence-backed security questionnaire, architecture/data-flow diagram, list of authorized subprocessors, data-handling terms and pilot delivery plan. Any answer must be verified for the specific app and current deployment before it is used to make a procurement decision.