Trust & safety
Security at Trove
Your workspace holds real work — drafts, numbers, plans. Here is what we do to protect it, in concrete terms rather than badges.
Passwords are never stored
Passwords are hashed with scrypt and a unique per-user salt. We keep the hash, never the password — there is nothing to leak.
Sessions are opaque and revocable
Sign-in creates a random 256-bit token, stored in our database only as a digest. The cookie is httpOnly, SameSite, and Secure in production — and every session is revoked when you reset your password.
Encrypted in transit, always
HTTPS is enforced with HSTS, and responses carry hardened headers: no MIME sniffing, no framing by other sites, and a strict referrer and permissions policy.
Your workspace is yours alone
Every data query is scoped to your account — projects, documents, agents, and artifacts are unreachable across accounts by construction, not by convention.
Integrations connect over OAuth
Third-party apps connect through OAuth, never by pasting passwords into Trove. You can review and revoke access from the integrations page at any time.
Staging never leaks into search
Preview deployments are served with noindex directives across robots, sitemap, metadata, and headers — only the production site is crawlable.
Payments never touch our servers
Checkout and card handling run entirely through Lemon Squeezy. We see plan status, never card numbers.
AI providers see prompts, not your account
Generating your work means sending prompts to third-party AI providers. They receive the text needed for the task — not your password, sessions, or other projects.
Connected apps act only with approval
An integration can read your data automatically, but sending, posting, or filing anything needs your explicit tap on an approval card first.
Your data is portable — and deletable
Export your workspace data anytime from account settings. To delete your account entirely, write to official@troveai.site and a person handles it.
Encrypted at rest
Production data lives on managed database infrastructure with encryption at rest, and every connection to it is encrypted in transit.
Report a vulnerability
If you believe you found a vulnerability in Trove, please report it privately before publishing details so we have a chance to investigate and protect users. Email official@troveai.site with the affected URL or feature, reproduction steps, impact, and a safe proof of concept if one is needed to explain the issue.
Please avoid
Do not access data that is not yours, disrupt the service, run destructive tests, exfiltrate secrets, or use social engineering. Stop testing once you have enough evidence to demonstrate the issue. Never send real passwords, API keys, or payment card details.