Security Policy

1. Overview

Protecting customer data is a core operating principle at Triven.ai, an AI Workflow Automation Platform owned and operated by CollabGlam LLC (CollabGlam). We implement administrative, technical, and organizational safeguards designed to protect customer information, business data, and connected third-party integrations — including the Meta WhatsApp Business Platform — against unauthorized access, disclosure, alteration, or destruction.

No system can guarantee absolute security. This page describes the security practices we have implemented and our ongoing commitment to improving them; it is not a guarantee of a specific outcome, and it should be read alongside our Privacy Policy, Terms of Service, Data Deletion Instructions, and Data Processing Addendum (DPA).

2. Security Principles

Our security program is organized around the following principles:

• Security by Design — security considerations are incorporated at the architecture and development stage, not added after the fact
• Least Privilege Access — access is granted only to the extent necessary for a role or function
• Data Minimization — we collect and retain only what is necessary to provide the service
• Customer Data Isolation — customer environments are logically separated in our multi-tenant architecture
• Encryption — data is protected in transit and, where appropriate, at rest
• Continuous Monitoring — systems are monitored for anomalous or unauthorized activity
• Responsible Disclosure — we maintain a channel for external researchers to report vulnerabilities in good faith

3. Infrastructure Security

Our platform operates over encrypted communication channels and is hosted on reputable cloud infrastructure. Measures include:

• TLS encryption for all web and API traffic
• Encrypted storage of sensitive credentials and secrets
• Environment-based configuration management, separating development, staging, and production environments
• Network-level protections, including firewalling of production systems
• Regular application of software updates and security patches to underlying infrastructure and dependencies

4. Data Encryption

Customer information is encrypted in transit using TLS. Triven.ai applies encryption and access restrictions to sensitive stored credentials, such as supported OAuth tokens, API credentials, and integration secrets, according to the sensitivity of the information and the applicable system design.

Passwords are never stored in plain text.

5. Authentication & Access Control

Access to customer data is governed by role-based access control (RBAC) and the principle of least privilege:

• User authentication is required to access any Workspace
• Permissions are scoped by role within a Workspace
• Access to a Workspace's data is restricted to users explicitly authorized within that Workspace
• Session management controls are in place to limit exposure from inactive or compromised sessions
• Administrative access to production systems is restricted to authorized personnel

6. Workspace Isolation (Multi-Tenancy)

Triven.ai is a multi-tenant platform. Triven.ai uses Workspace identifiers and authorization controls designed to ensure that users can access only the customer environments and records for which they have been granted permission:

• Customer data is partitioned by Workspace
• Workflow executions run within the context of their own tenant
• Connected integrations (e.g., WhatsApp Business, Telegram, CRM) are scoped to the Workspace that authorized them
• Integration credentials, workflow executions, files, conversations, and AI memory records are scoped to the applicable Workspace

7. AI Security & Data Handling

Triven.ai does not use customer data, end-user interaction data, messages, recordings, transcripts, uploaded files, workflow data, or information obtained through connected third-party services to create, train, or fine-tune generalized or shared artificial intelligence or machine-learning models. Where an authorized AI service provider processes information to generate a response requested through the Platform, that processing is performed only to provide the requested functionality and is governed by applicable contractual and technical data-protection controls. Access to AI functionality is scoped to the applicable Workspace and authorized workflow.

8. Third-Party & WhatsApp Business Platform Integrations

Triven.ai integrates with third-party platforms at the customer's direction, including but not limited to:

• Meta WhatsApp Business Platform
• Telegram
• Google Workspace
• Microsoft services
• Stripe
• Twilio

Each integration is authorized directly by the customer using that platform's supported authentication mechanism (e.g., OAuth). We do not access a connected platform beyond the scope of permissions the customer has granted. Customers may disconnect supported integrations through the Platform. When an integration is disconnected, Triven.ai disables the connection, removes or invalidates locally stored credentials, and, where supported by the provider, submits a request to revoke the corresponding authorization grant or access token. Customers may also revoke Triven.ai's access directly from the connected provider's account settings.

9. API Security

Non-public Triven.ai API endpoints require appropriate authentication and authorization. Access is evaluated according to the requesting user, Workspace, role, and permitted operation. Public integration endpoints, including third-party webhook endpoints, are protected using controls appropriate to the relevant provider. These controls may include request-signature verification, verification tokens, secret validation, timestamp checks, replay protections, and request validation.

Additional safeguards include TLS, Workspace-level authorization checks, input validation, secure handling of integration credentials, appropriate rate limiting or abuse controls, and logging of relevant security and operational events without intentionally recording plaintext passwords, private keys, or access tokens.

10. Monitoring & Logging

We maintain system logs to support detection, investigation, and resolution of operational and security events. Logged activity may include:

• Authentication events (login, failed login attempts)
• API request activity
• Integration connection/disconnection events
• Workflow execution activity
• Administrative actions on Workspace or account settings
• Application error logs

Logs are retained in accordance with our internal retention schedule and applicable legal requirements, and access to logs is restricted to authorized personnel.

11. Vulnerability Management

We work to reduce security risk on an ongoing basis by:

• Applying security patches to platform dependencies and infrastructure
• Monitoring dependencies for publicly disclosed vulnerabilities
• Reviewing and remediating identified security issues based on severity and risk
• Incorporating secure coding practices into our development lifecycle

12. Incident Response

If we become aware of a security incident that affects customer data, we will:

• Investigate the scope and cause of the incident;
• Take reasonable steps to contain and remediate the issue;
• Assess the impact on affected customers and data;
• Notify affected customers without undue delay where required by applicable law, regulation, or contractual obligation (including, where applicable, notification timelines under the GDPR and similar frameworks).

Specific notification commitments to enterprise customers may be further defined in an executed Data Processing Addendum (DPA) or Master Services Agreement.

13. Customer Responsibilities

Security is a shared responsibility. We recommend that customers:

• Use strong, unique passwords for their Triven.ai account
• Protect and rotate API credentials regularly
• Limit the number of users with administrator-level access
• Periodically review connected integrations and remove those no longer in use
• Remove unused or stale API tokens
• Report suspected suspicious activity to us immediately using the contact in Section 14

14. Responsible Disclosure

We welcome reports from security researchers who identify potential vulnerabilities in Triven.ai. If you believe you have found a security issue, please report it to us before disclosing it publicly, and include where possible:

• A description of the issue and its potential impact
• Steps to reproduce
• Any supporting evidence (screenshots, logs, proof-of-concept)

15. Compliance & Related Policies

Our security practices are designed to support applicable data protection and platform requirements. For related information, please see:

16. Changes to This Page

We may update this Security page periodically to reflect changes in our platform, infrastructure, legal obligations, or security practices. The Last Updated date above reflects the most recent revision.

17. Contact Us