LEGAL DIRECTORY

TrustLayer Privacy
Policy

Last Updated: Oct 16, 2026

We believe corporate data privacy should be transparent, uncompromising, and straightforward. This document outlines how TrustLayer securely handles, processes, and respects your organizational data across all services.

Table of Contents

DATA ARCHITECTURE & PRIVACY FRAMEWORK

Understanding Your Data

TrustLayer is engineered from the ground up around strict data minimization and cryptographic boundary controls. This document articulates our formal contractual and statutory commitments regarding data collection, custody boundaries, cryptographic protections, and user agency under GDPR, CCPA/CPRA, and global data privacy standards.

Summary

TL;DR: We strictly collect the minimal telemetry and identity records required to deliver cryptographic identity verification. We never sell your personal information or monetize telemetry data through secondary brokers.

1. Categories of Personal Data Collected

In executing digital trust infrastructure, TrustLayer acts as both a Data Controller for primary account relationships and a Data Processor for institutional verifications. Detailed disclosures by classification include:

  • Identity & Verification Credentials: Full legal name, enterprise email domain, public key identifiers, and encrypted cryptographic hash signatures used for authenticating organizational tenants.
  • System & Audit Telemetry: Anonymized client application runtime indicators, timestamped API interaction logs, encrypted token exchange headers, and TLS handshake telemetry.
  • Commercial Relationship Data: Billing addresses, contract identifiers, tax residency certificates, and audit logs stored via PCI-DSS Level 1 tokenized billing gateways.

Clause 1.4 (Zero-Knowledge Architecture): At no stage does TrustLayer hold plaintext cryptographic keys or unhashed personal credentials within persistent data repositories. For technical specifications, inspect our Cryptographic Protocol Addendum.

Summary

TL;DR: Processing occurs strictly pursuant to explicit customer contract performance and statutory legal compliance. We apply differential privacy guarantees across all analytical pipelines.

2. Processing Foundations & Legal Grounding

Under GDPR Article 6 and equivalent cross-border data protection frameworks, TrustLayer conditions every processing lifecycle event upon one of three statutory legal bases:

  • Contractual Performance: Processing necessary to provision cryptographic identity pipelines, validate authentication requests, and fulfill enterprise Master Service Agreements.
  • Legitimate Interests: Maintaining platform resilience, detecting intrusion attempts, and preventing fraudulent authentication cycles while preserving fundamental user rights.
  • Statutory Legal Obligation: Adherence to financial accounting mandates, export controls, and verifiable subpoena requests issued by jurisdictions with verified standing.

Clause 2.3 (Automated Evaluation Protection): TrustLayer does not deploy automated profiling or algorithmic decision pipelines that generate adverse legal or existential effects without documented human-in-the-loop review. Consult our Trust Assurance Registry for audit proofs.

Summary

TL;DR: We share data solely with audited, SOC2-certified infrastructure partners under strict Data Processing Agreements. Subprocessors are held to identical cryptographic standards.

3. Subprocessor Integrity & Cross-Border Transits

Subprocessors undergo continuous compliance screening. Cross-border transfers adhere to EU Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum. All transfers mandate end-to-end TLS 1.3 and hardware-level AES-256-GCM encryption at rest.

Summary

TL;DR: You possess uninhibited rights to export, correct, or permanently purge your identifiable information through self-serve admin tools or by contacting our Data Protection Officer.

4. Data Subject Rights & Regulatory Recourse

Irrespective of geographic residence, all platform operators and authenticated principals retain complete authority to exercise statutory privacy mandates without commercial penalty or service degradation:

  • Right to Erasure (Article 17 GDPR): Permanent tombstoning and irreversible key disposal for all non-statutory records within 30 days of verified submission.
  • Right to Portability (Article 20 GDPR): Machine-readable JSON structured export containing all active schema configurations and historical authentication records.
  • Right to Restriction & Objection: Granular opt-out controls for diagnostic telemetry processing without interrupting cryptographic validation pipelines.

Clause 4.6 (DPO Direct Channel): Formal inquiries or regulatory filings should be directed to our registered Data Protection Officer at [email protected]. All inquiries trigger an immutable ticketing record and 72-hour acknowledgment guarantee.