Privacy Policy

Who we are

TrustRail is operated by Keerthish Suresh, a sole trader in Western Australia trading as TrustRail (“we”). We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth), and we extend the rights below to everyone who uses TrustRail, wherever they are. Contact us at privacy@kynthiaai.systems.

For data your organization puts into a TrustRail workspace (for example, the actions your agents request), your organization decides what goes in and why; we process it on your organization’s behalf to provide the service.

What we collect

Your account

Your email address and display name, and the sign-in factors you set up. A password is stored only as an Argon2id hash; for a passkey we store its public key, never a secret. We record when your email address was verified.

Your workspace

The agents, policies, connections, approvals and members you configure; the actions your agents submit, the decisions made about them and the results; and the audit chain that records each step. Action payloads are encrypted at rest. Provider credentials you connect are stored encrypted, used only by the execution gateway, and never shown back to you or to an agent.

Technical information

We use the IP address of each request while handling it, for example to limit repeated sign-in attempts. We do not store the address itself: audit and security records keep only a one-way digest of it, enough to tell that two events came from the same place without recording where that was. Cloudflare, which carries traffic to the service, also processes it under its own terms.

The desktop app

The desktop app keeps the list of deployments you connect to on your computer. Its Setup Assistant reads a fixed list of known agent configuration files to show you what it found; credential values it finds never leave your computer.

Billing

Once paid plans are switched on, your billing contact and subscription status. Card details are collected and held by Stripe, not by us.

This website

The marketing site uses no analytics and sets no cookies. Our hosting provider keeps standard request logs.

Cookies

The console sets two first-party cookies, both needed for it to work: a session cookie that keeps you signed in (not readable by page scripts), and a security token that protects your actions against cross-site request forgery. There are no advertising or tracking cookies, so there is nothing to opt out of.

How we use it

• to provide the service: authenticate you, evaluate and execute actions, and keep the audit record;
• to secure it: detect abuse, rate-limit sign-in attempts, and investigate incidents;
• to contact you about your account, security, and changes to the service or terms;
• to meet legal obligations.

We do not sell personal information, we do not use it for advertising, and we do not use customer data to train machine-learning models.

Who else sees it

We use the providers below to run the service. Each receives only what it needs for its job and is bound by its own data-protection terms. Some are outside Australia, so your information may be processed overseas; we choose providers with recognised security programs.

The control plane itself, which holds workspace data and the audit record, currently runs on infrastructure we operate in Western Australia. We will update this page, and email workspace owners, before moving it. We disclose information to authorities only when the law requires it, and we will tell you when we are allowed to.

How long we keep it

Account information is kept while your account is open. Workspace data is kept for the retention period your workspace sets. To close a workspace, email privacy@kynthiaai.systems from an owner’s address; we delete its data within 30 days, except where the law requires us to keep something longer and except for its audit log.

The audit log is append-only and tamper-evident by design: each entry is chained to the one before it, so removing one would break the proof for every entry after it. It records what happened, who or which agent did it and when, using identifiers, decision outcomes and cryptographic digests. The content of an action is stored separately, encrypted, and is deleted with the rest of the workspace. We keep the audit log for as long as the law requires and for its integrity.

Backups are kept in an owner-only location on our infrastructure and rotated: we keep the 14 most recent, so deleted data leaves them within about 14 days. Action payloads and provider credentials stay encrypted inside them.

How we protect it

Traffic is encrypted in transit. Action payloads and provider credentials are encrypted at rest under keys held in a separate secrets service, and the key that signs execution authorizations never leaves it. Access to production systems is limited to the people who operate them. No system is perfectly secure; if a breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

Your rights

You can ask to access, correct, export or delete your personal information, or object to how we use it, by emailing privacy@kynthiaai.systems. We will respond within 30 days. Much of it you can change yourself in the console, and you can export your workspace’s evidence at any time.

Where personal information is part of a workspace your organization controls, we may need to refer your request to that organization. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or to your local data-protection authority.

Changes to this policy

When this policy changes in a way that matters, we will email workspace owners before the change takes effect and update the date above. These terms sit alongside our Terms of Service.