Trust and security

Trust isn't a badge. It's what happens behind the screen.

Every platform we build holds people's private lives: what they share, how they're doing, what they're working through. Here's how we protect it, and how we prove it.

Five promises we build around

01

Yours to own

Your platform runs on your own database, hosting and accounts. The code and the data belong to you.

02

Never sold

We never sell member data or use it for advertising. Not ours, not anyone's.

03

Never trains AI

No member audio, video or text is ever used to train or improve anyone's models.

04

Consent first

Behavioral features stay off until a member says yes, and a no never costs them their membership.

05

Walled off by role

Members, coaches, your team and you each see only what's theirs. Private stays private.

The vendor training rule

No member audio, video or text is ever used to train or improve a vendor's models. Opt out is the default: every vendor, every project, every request.

Before any vendor touches member content, we find its training setting, turn it off and write down where the proof lives. If a vendor's own documentation can't answer the question, the vendor doesn't get added. After any change that touches a vendor, a person checks that vendor's own logs. A setting in a dashboard isn't proof. The log is.

How we protect member data

These are the guards on the backend of every platform we build. Each one gets checked against proof before it appears here. If we can't prove it, it comes off this page.

Who can get in

  • Two step sign in on every account that reaches production
  • No shared accounts or shared passwords
  • Production access limited to named people, by role
  • Access removed the same day someone leaves
  • Work devices use disk encryption, screen lock and automatic updates

Every client walled off

  • Each platform has its own database
  • Row level security on every table, with a test that proves one member can't fetch another member's data
  • Member data never combined or compared across clients

Data locked down

  • Encrypted in transit and at rest
  • Secrets kept out of code and chat, and rotated right away if exposed
  • Service keys used on the server only
  • Every request checks who's signed in

Sensitive views logged

  • Admin views, exports, preview sessions, emergency access and consent changes all leave a record

Members in control

  • Behavioral features stay off until a member opts in
  • Opting out stops processing right away
  • Deletion reaches files, transcripts, summaries, search and backups on schedule
  • Every consent recorded: who, what, which version and when

No training on your data

  • No member data trains any model
  • Every vendor that touches member content has its training setting off, with proof recorded
  • A signed data agreement on file for every vendor
  • Only the minimum data goes to AI, and none for members who haven't opted in
  • Real member data is never pasted into AI tools, chats, tickets or screenshots

Built on throwaway data

  • We build and test on local or throwaway databases, never on real members
  • Automated checks run on our code and the tools it depends on

Backups you can trust

  • Backups run on a schedule
  • A restore has actually been tested

Audits and certifications

We'll list independent audits and certifications here as they're completed. We never claim one we don't hold, and we never call anything bank grade or military grade. Real trust is checkable.

Documents for clients

Before you sign anything, we'll share our Data Processing Agreement, the Platform Owner Stewardship Agreement and the subprocessor list for your platform.

Ask for a copy →

Found a security issue?

Thank you for looking out. Email team@tnrmconsulting.com with what you found and how to see it. We'll confirm we got it within 3 business days and keep you posted as we fix it.

While you look, please don't access or change anyone else's data, don't disrupt a live platform, and give us a fair chance to fix it before you tell anyone. [Attorney to review whether to promise no legal action for good faith reports that follow these rules.]

Privacy and legal

The details behind these promises live in our legal pages.