How we protect your data

Your case data lives in our operational database, scoped and access-controlled to your account. It is not visible to or accessible by any other client.

Your documents and extracted document text are held in a database and storage bucket dedicated solely to your firm, not shared with any other client.

All connections are encrypted in transit with TLS 1.2+.

Data is encrypted at rest with AES-256 across every database and document store.

Integration tokens and API keys are encrypted again at the application layer, with a key held outside the database.

Production access is restricted to authenticated Trellys staff.

Your data is stored in the United States.

We retain only the data needed to run your workflows. Data without an active purpose is not kept.

Your data and documents are automatically deleted within 90 days of termination, and you can request an export at any time before then.

Your content is not used to train AI models.

Your content is not retained by the AI provider after processing.

Firms can run AI on their own provider API keys.

Trellys is HIPAA compliant. We sign a Business Associate Agreement on request.

If a breach affects your data, including protected health information, we send your firm an initial notice within 72 hours of confirming it. Complete notification follows within the periods applicable law requires — for PHI, no later than 60 days after discovery, as required by HIPAA.

A current list of our subprocessors is available on request.

Trellys runs on SOC 2–audited cloud infrastructure.

Trellys carries professional liability, cyber, and general liability insurance. A certificate of insurance is available on request.

Incidents are handled by the Trellys engineering team. Phone: +1 (972) 433-0999. Member firms have a dedicated escalation line.

Encrypted database backups run daily.