Security you would expect from your own suppliers
In Triconform you keep sensitive information – undisclosed vulnerabilities, incidents, supplier contracts. That is why we state exactly how we protect it, and also what we do not have yet.
How we protect data in the application
Hosted in the EU
The application and database run in data centres in the EU (Hetzner, Germany). Backups are encrypted.
Encryption with your organisation’s key
Sensitive data, such as details of undisclosed vulnerabilities, is encrypted with your organisation’s key.
Two-step verification
Mandatory for all users. Nobody gets into the application without the second step.
Separation of organisations
Each organisation’s data is separated directly in the database (row-level security). Without the organisation being specified, the database returns no data.
Operator access
Our support can see your data read-only, only with your consent and only for the period you allow. In “Operator access” you see who accessed your data, when and why.
Integrity and time
Every record goes into a chained log with a timestamp, so a later change can be detected (tamper-evident). Check a document on the verification page or with the offline package.
No AI
Triconform does not use artificial intelligence. Your data does not go to any AI service.
Export and exit
You can export your data at any time. Documents you have issued remain verifiable without Triconform.
What we do not have yet, and what to be aware of
- We do not yet hold ISO/IEC 27001 certification. The measures described above are part of the application.
- A document can be checked for integrity and time, not for the identity of the issuer. We do not yet use an electronic seal.
- Deletion and backups: once an organisation is deleted, its data is immediately unavailable in the database; in the encrypted backups it disappears when the backup retention period ends.
- Vulnerability matching is an aid. An incomplete SBOM, delays in public databases or firmware without identifiers may mean a vulnerability is not found.
This website
- no cookies, no analytics and no third-party scripts or fonts,
- the contact form stores nothing – you send the message from your own e-mail program,
- report a vulnerability in the website or application as described in security.txt to info@abuco.cz.
Questions about security?
We are happy to discuss them in a demo or send you details for a tender or a supplier questionnaire.