How we protect your data

Your case data is held in a dedicated, single-tenant database.

Your documents are held in dedicated, single-tenant storage.

All connections are encrypted in transit with TLS 1.2+.

Data is encrypted at rest with AES-256 across every database and document store.

Integration tokens and API keys are encrypted again at the application layer, with a key held outside the database.

Production access is restricted to authenticated Trellys staff.

Your data is stored in the United States.

We retain only the data needed to run your workflows. Data without an active purpose is not kept.

Your data and documents are deleted on request when you leave.

Your content is not used to train AI models.

Your content is not retained by the AI provider after processing.

Firms can run AI on their own provider API keys.

Trellys is HIPAA compliant. We sign a Business Associate Agreement on request.

If a breach affects your protected health information, we notify your firm without unreasonable delay and no later than 60 days after discovery, as required by HIPAA.

A current list of our subprocessors is available on request.

Trellys runs on SOC 2–audited cloud infrastructure.

Trellys carries professional liability, cyber, and general liability insurance. A certificate of insurance is available on request.

Incidents are handled by the Trellys engineering team. Phone: +1 (817) 508-2702. Member firms have a dedicated escalation line.

Encrypted database backups run daily.