Last updated: 2 July 2026
Trust and security
This page sets out where your data lives, who we rely on to run Trivexis, how Trix uses your data, and what happens if there is a breach. It reflects how the product is built today, not a plan.
What you can count on
- Your contacts are yours. Cancel anytime, export everything in one click.
- We never use your data to train AI for other agents.
- We never sell your data, and we never compete with you using your relationships.
Where your data lives
Your workspace data is stored in Australia. Our database and file storage run on Supabase in its Sydney region. That is where your contacts, conversations, documents, and uploaded files sit. The Portal and the API run on Vercel in its Sydney region.
Some processing happens outside Australia. When Trix uses a model to draft or reason over your text, or to build the embeddings behind search, that text is sent to Anthropic and OpenAI, our AI providers, both of which operate outside Australia. The supporting services listed below each handle the specific data they need to do their job.
Who we rely on
We use a small set of established providers to run Trivexis. Each one processes only the data it needs for its part of the service.
| Provider | What it does |
|---|---|
| Supabase | Postgres database and file storage where your data sits |
| Vercel | Application hosting and the AI gateway |
| WorkOS | Identity, sign-in, and single sign-on |
| Stripe | Billing and subscriptions |
| Anthropic | Claude models that draft and reason for Trix |
| OpenAI | Text embeddings that power search |
| Upstash | Redis for rate limiting and short-lived state |
| Resend | Transactional email |
| Axiom | Application logging |
| Inngest | Background jobs |
| Better Stack | Uptime and status monitoring |
How Trix uses your data
Trix uses AI models to draft and to search. It does not train them. We do not fine-tune or train any model on your data. Your text goes to Anthropic whenever Trix needs a model to draft or reason for you: writing a reply or brief, running a task, naming a conversation, or building the memory that tailors Trix to you. It goes to OpenAI to build the search embeddings that let you find past work. Each time, the model's output comes back to your workspace and nothing you send is used to train a model of ours.
Your workspace is isolated. Every record is scoped to your organisation and protected by row-level security, so your voice and history shape your drafts alone, never another agency's.
Security practices
- Tenant isolation
- Every record is scoped to your organisation and protected by row-level security in the database. One agency's data cannot be read while we serve another.
- Encrypted connections
- Traffic between your browser, our services, and our providers uses HTTPS.
- Verified webhooks
- Billing events from Stripe and identity events from WorkOS are checked against a signing secret before we act on them, and rejected when the signature does not match.
- Single sign-on
- Sign-in, sessions, and organisation membership run through WorkOS AuthKit.
- Redacted logging
- Our logs record stable identifiers and redact secrets and personal information.
Independent testing and certification
We have not yet completed independent penetration testing or a formal certification such as SOC 2 or ISO 27001. When that changes, this page will say so. We would rather tell you the current state than imply a badge we do not hold.
If there is a data breach
If we detect a breach of your data that is likely to cause serious harm, we assess it and notify the affected individuals and the Office of the Australian Information Commissioner, in line with the Notifiable Data Breaches scheme under the Privacy Act 1988. We also tell the agencies whose data is involved, so they can meet their own obligations to the people in their books.
You can check whether Trivexis is running normally at status.trivexis.com.au.
Contact
For security or privacy questions, email paul.catamio@trivexis.com.au. You can also read our privacy policy.