Protected
Your information is secure at all times. Trustworthy requires robust passwords, two-factor authentication (including hardware keys), and AES 256-bit encryption to protect family data.
Private
We’ll never share or sell your information. You and your information are not our business model. We keep your information protected, secure, and available when needed.
Yours
You are the sole arbiter of your information. You alone decide whom to share it with and how you want to use it or benefit from it.
Partners
Trustworthy works with various security providers to enhance our security stack. We only work with providers who achieve the highest levels of security and privacy.
Member data may be stored using third-party partners’ secure cloud infrastructure to provide secure software services to members. Data stored in secure cloud infrastructure is not used for training or the benefit of third-party partner services.
Trustworthy Employee Security
Every Trustworthy employee undergoes rigorous background and security checks before hiring and twice-annual security and privacy training to ensure they understand our commitment to keeping member information safe.
Employee company applications and devices are centrally managed by a third party, which allows our security team to remove access to business applications at will and remotely freeze or wipe devices as needed.
Security is built into everything we do. This isn’t a platitude. It’s a foundational part of our team culture.
As we build Trustworthy, customer data is hidden at every step in the process so that customer information is never compromised.
Emergency Contact Identity Verification
When you invite Emergency Contacts to be part of your Family Operating System®, we ensure they are who they say they are with a thorough identity verification procedure.
We do this upfront so that in an emergency, they’re not spending valuable time validating themselves to get access to critical information.
Bug Bounty
Trustworthy runs a private bug bounty program to help surface and resolve security vulnerabilities before they can be exploited. We welcome your contributions by submitting reports using this form. Our Security Team will investigate, triage, and respond to your report.
Scope: We accept issues with an almost entirely open scope. Our primary hope is for submissions impacting secure.trustworthy.com that hosts our built application. We value vulnerabilities that impact our users, such as data compromise, more than our infrastructure such as DOS. Bugs on www.trustworthy.com will be accepted only if they lead to vulnerabilities or security issues on secure.trustworthy.com or other shared infrastructure, accounts, or domains. Otherwise, we will not be receiving reports for www.trustworthy.com.
Rules: Please follow all professional best practices when conducting investigation against Trustworthy. Including but not limited to: please take no actions that made lead to the destruction of a users data; please only seek to extract non-sensitive user information in your proof of concepts; please do not conduct scaled DOS attacks; please do not deliver real malware or otherwise activating payloads.
Severity/Classification: We use Gitlab’s definitions to determine a vulnerability’s severity. All severity and risk analysis will be reviewed by us and adjusted based on the risk to our users. For example: a vulnerability is present in our application but Trustworthy has deployed mitigation strategies to prevent exploitation. A researcher must prove those controls to be inadequate or circumventable to be awarded.
Awards: We offer rewards to valid submissions after our internal review process has concluded. The rewards are a sliding scale based on the severity and are subject to change.
Please reach out to security@trustworthy.com if you have any questions.
Frequently Asked Questions
How does Trustworthy import financial data from banks and other institutions?
