Built for
real conversations.
Treated like real evidence.

How TROVA handles audio.

• Encrypted in transit. TLS 1.3 for every transfer from wearable → app → cloud.
• Encrypted at rest. AES-256 on object storage (DigitalOcean Spaces).
• Customer-policy retention. Default 90 days; configurable per shop. Audio can be deleted on request.
• Owner-only access. Audio is access-controlled per role — technicians cannot view other technicians' calls.

Two-party consent compliance.

The TROVA workflow includes a pre-call consent step in all two-party-consent states (California, Florida, Massachusetts, Washington, Illinois, New Hampshire, Montana, Pennsylvania, Maryland, Connecticut). Technicians are coached to verbally confirm consent before recording begins.

In one-party states, TROVA captures audio with technician consent by default. Customers can be informed at the discretion of your shop's policy.

SOC 2.

SOC 2 Type 1: In progress. Targeting completion Q3 2026.

SOC 2 Type 2: Following Type 1.

Subprocessors.

The third parties that touch your data (audio storage, transcription, AI inference, email) are listed publicly. See: /subprocessors/

Incident response.

TROVA maintains an incident-response runbook. In the event of a security incident affecting customer data, we notify affected customers within 72 hours.

Questions.

Security or privacy questions: security@hellotrova.com