Security
Your clients' data, kept where it belongs.
Trelyn holds your pipeline, your clients' work and their documents. Here is how the product keeps workspaces apart, decides who sees what, and records what changed, stated as it is built, nothing more.
In the product
Access, isolation and a record of change.
Workspace isolation
- Every read and write is scoped to the workspace it belongs to
- A record from another workspace is simply not found
- Files, search and AI retrieval follow the same boundary
Roles and permissions
- Owner, Admin, Member and a read-only Viewer role
- Custom roles built from fixed permissions, for example whether deal values or financials are visible
- The most sensitive actions, like deleting the workspace, cannot be handed to a custom role
External members
- Freelancers get a whole client, or single projects or deals, nothing more
- Their permissions are chosen per person
- Settings, the rest of the CRM, commissions and the portal stay closed to them
A separate client portal
- Clients never get an account in your workspace
- Access is granted per contact, per portal, project or deal room
- Clients are told what activity is recorded and for how long; you choose 6 to 60 months
Activity log
- Creates, updates and deletes on core records are logged with the fields that changed and who changed them
- The log is append-only: entries cannot be edited or removed
- Visible to workspace owners and admins
Sign-in and sessions
- Passwords are hashed with scrypt and a unique salt
- Sessions are stored server-side as hashes, in an HTTP-only cookie
- Changing your password signs out your other sessions
- Repeated failed sign-ins are slowed down; emailed sign-in codes expire after 15 minutes
Files and secrets
- Files are kept in private S3-compatible object storage, reached only through short-lived signed links
- Access is checked on the server before every download, upload or delete
- Credentials for connected services are encrypted with AES-256-GCM
- Invitations, sessions and recovery codes are stored only as hashes
API and MCP tokens
- Personal tokens, shown once and stored only as a hash
- Read only by default; writing is a separate choice
- Every call is checked against the person's current permissions
- Revoke a token at any time; write actions are logged
AI within your permissions
- AI answers draw only on records the person asking may see
- Suggested changes do nothing until a person applies them
- AI never computes report figures or triggers automations
Our own access
Trelyn staff access is limited and logged.
The people who run Trelyn work from a separate, internal console, never from a customer account, and support access to a workspace leaves a trace you can see.
- Staff use separate accounts on a separate host, with multi-factor authentication required
- Staff sessions end after at most 12 hours, and after 2 hours of inactivity
- Opening a workspace for support requires a written reason and expires automatically
- Every action during support access is audited, and changes are marked as such in your workspace's activity log
- Staff actions are kept in an append-only audit log
On the web
Safe defaults in the browser.
- HTTPS with HSTS
- Pages cannot be framed by other sites, except the booking card made to be embedded
- Content-type sniffing off, a strict referrer policy, and no camera, microphone or location access
- A client review link stops working as soon as you replace it
Operations
Watched, and open about it.
- Trelyn runs as separate containerised services: the app, this website and the staff console
- Health checks for the application, storage and AI services
- Service status is published at status.trelyn.nl
What we don't claim
No badges we haven't earned.
Trelyn does not currently hold third-party certifications such as ISO 27001 or SOC 2, and this page lists none. If your organisation has a security questionnaire, or needs to know where data is hosted and how it is processed, ask us, we answer from how the system is actually built.