Security
Security at TR-AI
The controls that protect your data, your customers' data and the integrity of your support operations — described as they are implemented today.
TR-AI does not currently hold third-party security certifications (such as SOC 2 Type II or ISO 27001). The controls below are implemented in the product today; certifications will be listed here only once an independent audit is complete.
Implemented controls
Per-customer encryption keys
Every customer account has its own 256-bit data key. Credentials and secrets are encrypted with AES-256-GCM under that key.
AWS KMS key wrapping & rotation
On Growth Pro each account gets its own data key, wrapped by AWS KMS when configured, rotated every 90 days and re-wrapped when the KMS key rotates.
MFA, SSO & RBAC
Multi-factor authentication and role-based access control for dashboard users on every plan; SAML single sign-on and an enforced MFA policy on Growth Pro.
Audit logs
Settings, credential, export, erasure, API-key and webhook changes are logged with user and IP. Audit logs are kept 90 days on Starter, 12 months on Bronze and for the period you choose (up to 84 months) on Growth Pro.
Configurable retention
Ticket data is deleted automatically after 90 days on Starter and 12 months on Bronze. On Growth Pro you choose the period, from 1 to 84 months (24 by default).
GDPR & CCPA data-subject tooling
Erase a customer's stored data on request, and delete an entire account with all its data, immediately from the dashboard.
How we protect your data
Data encryption
- Help-desk, knowledge-base and connector credentials encrypted at rest with AES-256-GCM
- Encryption at rest on every plan; on Growth Pro, envelope encryption with a separate data key per customer account, wrapped by AWS KMS (or the platform master key when KMS is not configured)
- Customer data keys rotated automatically every 90 days; stored secrets are re-encrypted under the new key
- All traffic to the dashboard and API is served over HTTPS
Access control
- Every API request is checked against the account that owns the data — deny by default
- Role-based access control (RBAC) for dashboard users
- Multi-factor authentication on every plan; SAML single sign-on (SSO) and an enforced MFA policy on Growth Pro
- Inbound help-desk webhooks verified with per-account secrets or signatures
Data isolation & AI safety
- Strict tenant isolation — every query is scoped to your account, and your data is never used to train models for other customers
- Personal data (emails, phone numbers, card numbers, IBANs, national ID numbers, API keys) is tokenised before it is sent to the LLM for ticket resolution, copilot drafts, churn scoring and spike labelling, and restored only in what your customers and agents see
- Every incoming ticket is screened against 28 prompt-injection patterns before it reaches the model
- Security audit log of account changes and data exports — 90 days (Starter), 12 months (Bronze) or up to 84 months (Growth Pro)
Transparency & operations
- Full audit trail per ticket: sources used, confidence, outcome and every agent override — exportable as CSV
- Live status page with measured uptime and automatically recorded incidents
- AI kill switch: pause all automated replies for an account instantly
- Responsible disclosure — security reports are answered within 24 hours
What data we access and why
Data category
Access
Purpose
Ticket content
Read
Required to analyse and resolve tickets. Retained 90 days on Starter, 12 months on Bronze, and 1 to 84 months (24 by default) on Growth Pro.
Customer email addresses
Read
Used for ticket history lookup and churn signals. Tokenised before any LLM call. Never used for marketing.
Knowledge base articles
Read
Indexed for retrieval during resolution and re-synced on a schedule. Customer erasure requests and account deletion take effect immediately, within 60 seconds.
Agent responses (historical)
Read
Used as ticket-history evidence for future answers. Personal data is tokenised before any LLM call.
Responsible disclosure
Found a vulnerability? We take security reports seriously and respond within 24 hours.
security@ticketresolve.aiPGP key available on request for sensitive disclosures.
Need security documentation?
A data processing agreement (DPA) and a description of our security controls are available on request.
Request security docs