DataTruth issues an independent verdict on whether a company's data can support AI and value creation. That demands the highest bar on how we handle data - so the platform is privacy-by-design: it reads systems to measure quality and stores the measurements, not the data.
We never store your raw client records.
The platform analyses data in memory and persists only quality metrics and metadata. This isn't a policy promise bolted on afterwards - it is how the system is built.
This is an AI-readiness product that scores your data without sending it to any AI. The Truth Score™ engine is fully deterministic - field profiling, duplicate and anomaly detection, cross-system reconciliation - with no large language model anywhere in the assessment path. Your records are never transmitted to OpenAI, Anthropic, or any external model, and are never used to train anything. That means the score is reproducible and defensible, and there is no hallucination and no data-leakage surface where it matters most: your portfolio's actual data.
When we assess or monitor a system, we process the data transiently in memory and persist only aggregate metrics and metadata - for example "82% email completeness", duplicate rates, field fill-rates - never the underlying raw records. For connector-based monitoring we retain the connection and the metric history, not copies of your data; record-level evidence is fetched live on demand and not stored. This minimises personal data at rest by design.
All traffic is served over TLS. Integration credentials (OAuth tokens, connection secrets) are encrypted at rest with AES-256-GCM, with key versioning and rotation support so keys can be rolled without downtime. The database enforces row-level security; service-role access is server-side only.
Staff access to the admin platform is authenticated via Clerk with a strict email allowlist and role-based access control (super-admin, org-admin, analyst, viewer). Client portal access uses one-time email codes with short-lived, scoped sessions and per-email + per-IP rate limiting on authentication. Fund- and company-level access scopes are enforced at the data layer.
We act as processor for the data inside the systems we assess (the client is controller), governed by a Data Processing Agreement. The platform provides data-export and erasure-request endpoints, EEA-first hosting, and sub-processors bound by GDPR-compliant terms and, where relevant, Standard Contractual Clauses. A 72-hour breach-notification process is documented.
Security-relevant actions are written to an append-only audit log (updates and deletes are blocked at the database level). The Truth Score™ methodology is deterministic and version-stamped: the same input yields the same score every time, and every assessment records the engine and methodology version used - so a result can be reproduced and defended to an investment committee.
The platform runs on managed, auto-scaling infrastructure with scheduled snapshots and monitoring. Application errors are captured to a dedicated monitoring service, and operational failures (e.g. a failed scheduled job) raise alerts so issues surface before clients do.
DataTruth is GDPR-aligned today, with the architecture and documentation that a formal certification builds on. We maintain an information-security policy, a data-retention policy, and an incident-response plan, and our roadmap includes a SOC 2 readiness programme and independent penetration testing as we scale. We'd rather tell you exactly where we are than imply a badge we don't yet hold - that is the whole point of an independent-verdict business.
Our full documentation pack - Privacy Policy, Data Processing Agreement, Sub-processors list, Information Security Policy, Data Retention Policy and Incident Response Plan - is available to prospects and clients on request, under NDA.
Security or diligence questions?
Request the documentation pack or a security review.
We use privacy-friendly analytics (IP anonymised) to understand how the platform is used. Nothing is loaded until you agree.