Built for
real conversations.
Treated like real evidence.

How TROVA handles audio.

• Encrypted in transit. TLS 1.3 for every transfer from wearable → app → cloud.
• Encrypted at rest. AES-256 on object storage (DigitalOcean Spaces, US region).
• Customer-policy retention. Default 90 days; configurable per shop down to 30 days or up to 7 years. Audio can be deleted on request within 72 hours.
• Role-based access. Owners see everything. Managers see their book. Technicians see only their own calls.
• Audit log. Every audio access is logged with user, timestamp, and reason. Tamper-evident.

Two-party consent compliance.

The TROVA workflow includes an automated pre-call consent step in all two-party-consent states: California, Florida, Massachusetts, Washington, Illinois, New Hampshire, Montana, Pennsylvania, Maryland, Connecticut. Recording cannot start until the technician verbally confirms the customer's consent.

In one-party-consent states, TROVA captures audio with technician consent by default. Customers can be informed at the discretion of your shop's policy.

For multi-state operators: TROVA detects the customer's address state and applies the appropriate consent workflow automatically.

SOC 2 — what we can share now.

TROVA is pursuing SOC 2 Type I (target: Q3 2026) and SOC 2 Type II (target: Q1 2027), with continuous controls monitoring through Vanta. While we're pre-attestation, we can share:

• Our security questionnaire (Vanta Trust Center on request)
• A SOC 2 progress letter for procurement teams who need it
• Our internal controls list (access management, change management, encryption, vendor management, incident response)

Many enterprise IT teams accept pre-attestation vendors with a defined Type I target date. We'll work with yours.

Subprocessors.

The third parties that touch your data (audio storage, transcription, AI inference, email delivery) are listed publicly and updated when they change: /subprocessors/

30-day advance notice on any subprocessor change, via the email address you signed up with.

Incident response.

TROVA maintains an incident-response runbook with named on-call rotation. In the event of a security incident affecting customer data, we notify affected customers within 72 hours with: what happened, what data was affected, what we've done, and what we recommend you do.

Penetration testing.

Annual third-party penetration test. Most recent report available under NDA on request.

Questions.

Security, privacy, or compliance questions: security@hellotrova.com

Looking for our Data Processing Agreement (DPA), Mutual NDA, or AI usage policy? Same address.