Security

You stay in control

• House rules. For each kind of action (reading, drafting, sending, posting, money) you choose Do it, Ask, or Never. “Ask” puts an approval box in front of you first, and you can edit before approving.
• Undo. When a Trove sends something you allowed it to do on its own, you get 10 seconds to undo it.
• Read-only background work. The nightly check-in can only read. It can't send or change anything.
• Receipts. Every real action shows a Done (or Didn't work) box with the proof behind it, and an honesty check catches a Trove that claims something it didn't do.

Accounts and access

• Sign-in is with Google or a one-time email link, run by Supabase Auth. Trove has no passwords to leak.
• Every row in our database is protected by row-level security: your account can only read and change your own data. Server-only keys never reach the browser.
• The admin area is limited to a short allowlist of team accounts.

Connected apps

• Apps connect through their official sign-in (OAuth) or an API key, via Composio. Tokens are held by Composio, not in Trove's database.
• Each Trove only gets the tools for the apps it needs, and you can disconnect any app at any time in Settings → Connectors.
• Code changes on GitHub go on a new branch and a pull request unless you say otherwise.

Data protection

• All traffic is encrypted in transit (HTTPS with HSTS). Data is stored with Supabase and Vercel and encrypted at rest by them.
• Invoice links use long random IDs (about 131 bits), and the build-in-public page is off until you turn it on.
• Incoming webhooks are verified: Paddle billing events by signature, and WhatsApp messages (once switched on) by Meta or Twilio signatures.
• Payments are handled by Paddle. Trove never sees or stores card numbers.
• You can export or permanently delete your data in Settings → Data controls.

AI providers

• To write a reply, the text of your request and the app content it needs are sent to our AI model provider, currently Google's Gemini API.
• While we use Gemini's free tier, Google may use that content to improve its products. Avoid sharing highly sensitive information in chats until we move to a paid tier; the Privacy Policy will say when we do.
• We don't use your data to train AI models ourselves.

Reporting a problem

If you think you've found a security issue, please email hello@trytros.com with details. Please give us a reasonable chance to fix it before sharing it publicly, and don't access other people's data while testing. We'll reply as quickly as we can.