{"organization":{"name":"FillTrust","legalName":"FillTrust","country":"France","url":"https://www.filltrust.com"},"lastReviewed":"2026-08-30","canonical":"https://www.filltrust.com/trust","notice":"Self-assessment published by the vendor. This is not an audit, an independent assessment or an authorization. FillTrust holds no SOC 2 report and no ISO 27001 certificate, and states so in the answers below rather than omitting the question.","certifications":[],"contact":{"security":"mailto:security@filltrust.com","privacy":"mailto:privacy@filltrust.com","general":"mailto:help@filltrust.com"},"answers":[{"question":"Is customer data encrypted in transit and at rest?","answer":"Yes. Everything is encrypted in transit with TLS and at rest by Google Cloud. TOTP secrets are additionally encrypted at the application layer with AES-256-GCM, so a database read alone does not yield a working second factor.","updatedAt":"2026-08-30","controls":["sc-8","sc-28"]},{"question":"How is one customer's data kept separate from another's?","answer":"Every API request derives its tenant from the authenticated session, server-side. No endpoint accepts a customer identifier from the browser, and a request for another tenant's data returns 404 rather than confirming the record exists.","updatedAt":"2026-08-30","controls":["ac-3","sc-4"]},{"question":"Where is customer data stored?","answer":"Documents are stored in Google Cloud in Paris and the database is hosted in Frankfurt, both of them in the EU. Question text and the specific excerpts used to answer are sent to AI providers in the United States under Standard Contractual Clauses. Neither provider trains on API data.","updatedAt":"2026-08-30","controls":["sa-9"]},{"question":"Do you train models on customer data?","answer":"No. We call Google and OpenAI through their standard business APIs, whose terms exclude API content from training. To be precise about what that does and does not mean: it is a contractual commitment not to train on your content, and providers may still retain it briefly for abuse monitoring under their own published policies. We do not hold a zero-retention agreement with either provider, and we would rather say so than imply a guarantee we have not bought.","updatedAt":"2026-08-30","controls":[]},{"question":"Do you maintain a current SOC 2 Type II report?","answer":"No. FillTrust does not hold a SOC 2 report or an ISO 27001 certificate. This page and our security documentation are what we have instead, and we would rather publish that plainly than let the question go unanswered. If certification is a requirement for you, tell us. It is the kind of thing that changes a roadmap.","updatedAt":"2026-08-30","controls":["ca-2"]},{"question":"Do you delete customer data on request?","answer":"Yes. Deleting your account cancels billing, removes every uploaded document and generated questionnaire from storage, and deletes your records. If any part of that cannot be completed the deletion is aborted and reported rather than partially applied.","updatedAt":"2026-08-30","controls":["si-12"]},{"question":"Do you maintain a sub-processor list, and will you sign a DPA?","answer":"Yes to both. The current sub-processor list and our Data Processing Agreement, including the Standard Contractual Clauses, are published rather than sent on request. You should not have to ask for either.","updatedAt":"2026-08-30","controls":["sa-9"]},{"question":"Is multi-factor authentication available?","answer":"Yes. Accounts are protected by a password with optional TOTP two-factor authentication, and authentication endpoints are rate limited. Enforced SSO is not currently supported.","updatedAt":"2026-08-30","controls":["ia-2"]},{"question":"Can you show who changed an answer, and when?","answer":"Yes. Every answer change is recorded: what it was, what it became, who changed it and when. That includes answers submitted by outside experts through a review link. Generated answers cite the passages they were drawn from, and a citation that cannot be verified against the source lowers the answer's grade rather than being published.","updatedAt":"2026-08-30","controls":["au-2","au-3"]},{"question":"How do you handle reported vulnerabilities?","answer":"There is a published disclosure policy on our security page and a security.txt at the standard location, both naming a contact that reaches a person. It commits to acknowledging a report within five working days and offers safe harbour for good-faith research within a stated scope. We do not run a paid bug bounty and say so rather than implying one.","updatedAt":"2026-08-30","controls":["ra-5"]},{"question":"What is your incident notification commitment?","answer":"The commitment in our DPA governs, and it is the document to hold us to. Operationally, uptime is checked continuously, backend errors raise an alert, and object storage is versioned so an accidental overwrite is recoverable.","updatedAt":"2026-08-30","controls":["ir-6","si-4","cp-9"]}],"subprocessors":{"lastUpdated":"2026-08-30","url":"https://www.filltrust.com/legal/subprocessors","entries":[{"name":"Google Cloud Platform","purpose":"Application hosting and document storage","data":"Uploaded documents, questionnaires, generated answers","region":"europe-west9 (Paris)"},{"name":"Neon","purpose":"Managed PostgreSQL database","data":"Account details, answers, document text and embeddings","region":"AWS eu-central-1 (Frankfurt)"},{"name":"Google (Gemini API)","purpose":"Generating questionnaire answers","data":"Question text and the retrieved excerpts used to answer it","region":"United States"},{"name":"Anthropic","purpose":"Fallback answer generation (configurable, not currently in use)","data":"Question text and the retrieved excerpts used to answer it","region":"United States"},{"name":"OpenAI","purpose":"Text embeddings for retrieval","data":"Document excerpts and question text","region":"United States"},{"name":"Stripe","purpose":"Payment processing","data":"Billing details, email address","region":"United States"},{"name":"Resend","purpose":"Transactional email","data":"Email addresses, notification content","region":"United States"},{"name":"Google Analytics","purpose":"Counting visits to public pages, for visitors who consent","data":"Page address with single-use tokens removed, IP address, user agent","region":"United States (EU-US Data Privacy Framework)"},{"name":"Cloudflare","purpose":"DNS, CDN and DDoS protection","data":"Request metadata (IP address, user agent)","region":"Global edge network"}]},"documents":[{"title":"Security overview","url":"https://www.filltrust.com/security"},{"title":"Data Processing Agreement","url":"https://www.filltrust.com/legal/dpa"},{"title":"Sub-processor list","url":"https://www.filltrust.com/legal/subprocessors"},{"title":"Trust Center","url":"https://www.filltrust.com/trust"},{"title":"Privacy policy","url":"https://www.filltrust.com/privacy"}],"published":["Data Processing Agreement","Sub-processor list","Security overview"]}