At Treno we understand that our customers expect us to protect their data with the highest standards and are committed to providing them with a highly secure and reliable environment.
We know the data you upload to Treno is private and confidential. We regularly conduct user access reviews to ensure appropriate permissions are in place, in accordance with the least privilege principle. Employees have their access rights promptly modified upon change in employment.
Treno implements a security-oriented design in multiple layers, one of which is the application layer. The Treno application is developed by Treno full-time employees according to the OWASP Top 10 framework and all code is peer reviewed prior to deployment to production.
Our controlled CI/CD process includes static code analysis, vulnerability assessment, end-to-end testing, unit testing which addresses authorization aspects and more. Additionally, Treno developers go through periodic security training to keep them up-to-date with secure development best practices.
Since launch, Treno has consistently met or exceeded a 99.9% uptime, ensuring customers can access our products and services without interruption.
Corporate Security Standards
Treno ensures that security policies are maintained, communicated, and followed. All contractors and employees are required to pass a background check and sign confidentiality agreements, complete security training as part of the entry into the organization. Additionally, employees receive routine security awareness training and confirm adherence to Company security policies
All Treno data is covered by the highest security standards. Any data as well as any connections you make while accessing Treno are completely secure. Sensitive data is encrypted at rest and analytics are encrypted in transit with either TLS or HTTPS. Additionally, all connections with the Treno app are encrypted using SSL
Treno encrypts all data both in transit and at rest:
- Traffic is encrypted using TLS 1.3 with a modern cipher suite, supporting TLS 1.2 at minimum
- User data is encrypted at rest across our infrastructure using AES-256 or better
- Credentials are hashed and salted using a modern hash function
Disaster Recovery and Backups
Treno is committed to providing continuous and uninterrupted service to all its customers. We consistently backup user data every six hours. All backups are encrypted, where they are retained for 20 days.
Our Disaster Recovery Plan is tested at least once a year to assess its effectiveness and to keep employees aligned with their responsibilities in case of a service interruption.
Treno hosts its customer data in the Google Cloud Platform (GCP) data centers in the United States.
Hosting Options - EU
If a new EU customer wishes to have their data processed within the EU it must be requested BEFORE onboarding. If approved by Treno, we will create a unique account for that customer. The data connected to that account will be stored in an EU Google Cloud Platform data center in Germany and never backed up or replicated to a server elsewhere.
Another layer of security is the infrastructure. As stated, Treno is hosted on GCP and soon will be across multiple GCP regions for redundancy. Furthermore, our infrastructure is protected using multiple layers of defense mechanisms, including:
- Firewalls for enforcing IP whitelisting and access through permitted ports only to network resources
- A web application firewall (WAF) for content-based dynamic attack blocking
- DDoS mitigation and rate limiting
- NIDS sensors for early attack detection
- Advanced routing configuration
- Comprehensive logging of network traffic, both internal and edge
Least Privilege Access
Only a limited set of employees have access to the data stored in our databases. There are strict security policies for employee access, all security events are logged and monitored, and our authentication methods and data are strictly regulated. Access to production data requires multi-factor authentication and a one-time password.
We limit access to customer data to employees with a job-related need, and require all these staff members to sign a confidentiality agreement. Accessing customer data is only done on an as-needed basis, and only when approved by the customer (i.e. as part of a support incident) via a support token, or under authorization from senior management and security for the purposes of providing support, maintenance, or improving service quality.
Treno is a cloud-based company, with no part of our infrastructure retained on-premise. We maintain physical security in our physical office location including access control by personal cards, CCTV and alarm systems.
Treno’s data centers are hosted on Google Cloud Platform infrastructure, where industry-leading physical security measures are employed.