Security posture
This page distinguishes what applies to the public website, what must be verified for a product release, and what belongs to a customer's deployment and authorization process.
The marketing website is a static site delivered over HTTPS. Public forms submit to a separate API with input and request controls before records reach managed storage.
This site is not an approved channel for classified information, CUI, export-controlled technical data, procurement-sensitive or source-selection information, credentials, incident evidence, or customer tenant data. Obtain a written approved channel and handling instructions first.
Product claim boundary
Trunnion materials describe designed or configurable capabilities. Whether they exist, are enabled, or satisfy a specific control is established for the exact release and environment.
Trunnion AI does not claim through this website to hold an ATO, FedRAMP authorization, CMMC certification, SOC 2 report, security clearance, export authorization, or another third-party certification unless a current, scoped evidence package expressly states it. Alignment is a design or mapping objective, not independent validation.
Before production or regulated use, review the system that will actually be deployed, not a generic marketing description.
Current diagrams showing trust boundaries, providers, storage, and every external connection.
Roles, key management, administrative access, tool permissions, and approval-gate configuration.
Tenant-isolation tests plus deletion, backup, legal-hold, and recovery behavior.
Dependency and vulnerability results, release provenance, patch practice, and supported-version policy.
Audit-record fields, integrity tests, approval records, model inventory, and replay behavior.
Incident, continuity, recovery, notification, subprocessor, contract, and export-control procedures.
The VP of Engineering coordinates technical response; the Chief Legal Officer coordinates legal and notification assessment. Current exercise evidence is provided through diligence rather than implied by a public date.
Suspected compromise, cross-tenant exposure, unauthorized tool action, approval-gate bypass, harmful or materially incorrect consequential output, or loss of required audit evidence.
Include the affected URL or asset, reproducible steps, impact, and a safe way to contact you. Do not access data that is not yours, disrupt service, use social engineering, or place sensitive data in the report.
contact@trunnion.ai View machine-readable security.txtTell us the product, environment, data class, and review process. We will route the request to the right technical and legal owners.
