Trustvice runs on Cloudflare for the platform — Workers for compute, R2 for exports. Customer records and content live on Cloudflare D1 or Amazon Web Services RDS, in the region you pick at workspace creation. Each workspace gets its own region-pinned data store. We do operate a staff admin console — and every action it takes against your workspace writes a hash-chained, append-only entry into your Tops ledger. Append-only by SQLite trigger, visible to you, independently verifiable. Admin access exists. It just can't be silent.
100%
Of admin reads land in your Tops ledger
20+ regions
Across Cloudflare D1 + Amazon Web Services RDS, your choice
Per-tenant
One workspace database, region-pinned, never shared
The stack
Cloudflare D1 — database (option A)
Workspace records, agent registries, run metadata when the customer picks Cloudflare as their data provider. SQLite-based, region-pinned at workspace creation (one of 6 global regions). 10 GB per database; we provision one per workspace so there is no shared multi-tenant DB. EU jurisdiction binding available for hard GDPR Article 44 residency.
Operated by Cloudflare. SOC 2 Type II. ISO 27001. ISO 27018.
Amazon Web Services RDS — database (option B)
Workspace records, agent registries, run metadata when the customer picks Amazon Web Services RDS as their data provider. Managed Postgres, region-pinned at workspace creation (one of 13+ AWS regions including São Paulo, Cape Town, Mumbai, Tokyo). One Postgres instance per workspace.
Amazon Web Services (Aurora) infrastructure. SOC 1/2/3. ISO 27001.
Cloudflare R2 — object storage
Export bundles (TRAIGA evidence packs, EU AI Act Article 12 packs, raw JSON ledgers). S3-compatible, region-pinned to match the workspace's database region, zero egress. Buckets are workspace-scoped; access is by signed URL, never by shared credential.
Operated by Cloudflare. Same compliance posture as D1.
Cloudflare Workers — compute
Plugin ingest endpoint, Avonao Billing webhook handler, export generator, replay sandbox. Stateless workers; per-request authentication via workspace-scoped tokens. No persistent compute under our administration.
Operated by Cloudflare. Workers Paid plan ($5/mo) covers all serverless compute.
Avonao Billing — payments only
All payment data. We never see card details. Customer Portal handles subscription, payment method, history, and run-pack purchases. Webhook signatures verified. Avonao Billing Tax handles US sales tax and EU VAT.
Operated by Stripe. PCI DSS Level 1.
The dashboard and marketing site run on Vercel. No customer data flows through Vercel — its role is to serve the Next.js frontend at the edge. Authentication, data, billing, and compute are all on Cloudflare and Avonao Billing.
Controls in place from day one
Append-only ledger by construction
Record entries are content-addressed and chained. Each entry's hash includes the previous entry's hash. Modifying or deleting an entry breaks the chain — detectable at next verification.
Workspace-scoped tokens, no shared API keys
Plugin ingest tokens are scoped to a single workspace. Lost or rotated, they only affect that workspace. Auditor read-only tokens are a separate scope with no write capability.
Admin reads land in your Tops ledger — and you control which kinds are recorded
The staff admin console exists for legitimate operational work — incident triage, billing reconciliation, abuse response. Every read against a customer workspace writes an append-only Tops entry visible to that workspace. SQLite triggers enforce append-only at the database level, so even the admin console can't rewrite the audit trail of its own actions. The 9 Infrastructure kinds and 5 Spot kinds are customer-configurable per workspace (env filters, sampling rates, per-kind toggles) — kill-switch-floored to the actions that must always be recorded.
Jurisdictional data path
Pick WEUR (Europe) or ENAM (US) at workspace creation. D1 and R2 are pinned to the selected jurisdiction; Workers compute is configured with Regional Services to keep processing in-jurisdiction.
Encryption in transit and at rest
TLS 1.3 for all customer traffic. D1 and R2 encrypt at rest with provider-managed keys; per-workspace signing keys for exports are held in Cloudflare Secrets, accessible only to the workspace's Worker.
No third-party telemetry on customer data
No third-party APM or analytics has access to customer record content. The marketing site uses Cloudflare Web Analytics (cookieless) for aggregate page views only.
Per-tenant database isolation
One database per workspace, whether you pick Cloudflare D1 or Amazon Web Services RDS. Cross-tenant queries are structurally impossible because there is no shared schema to query against. Workspace deletion is a database drop.
Personnel access logged
Every staff data-plane read writes a Tops entry against the affected workspace, with the staff member's identity, the timestamp, and the reason. The admin console authenticates via Cloudflare Access + per-administrator WebAuthn + per-admin API tokens. Provider-side admin access (Cloudflare admin, Avonao Billing admin) is logged at the provider.
Customer-first data access
No Trustvice operator — support, engineering, compliance, executive — holds standing access to your workspace, your audit log, or your agent action logs. Every operator-side read happens through one of two paths, both visible to you after the fact, both written into your own hash-chained custody log. We have the technical ability to access everything; we are bound by these policies and our terms to use that ability only inside the documented paths.
Codified in audit policy 37.
Path A — You approve, by default
You either proactively grant support a time-boxed access window from /app/account/support-access ("I need help — please look at my workspace") or you review and approve / restrict / deny an admin-initiated request. Grants are scoped, time-boxed (15 min – 72 h), request-budgeted, and revocable instantly.
Path B — Legal override (narrow carve-out)
Subpoenas, regulator requests, confirmed safety reports, and corroborated fraud signals can authorise access without your consent. The ceremony requires three independent WebAuthn-asserted sign-offs: CISO + General Counsel + CEO. Default TTL 24 h, maximum 7 d, no silent extensions. You are notified — immediately or post-hoc when the court order requires deferral. Counted in our annual transparency report at /app/support/transparency.
Logs are yours, too
The audit log, agent action log, Tops entries, custody entries, billing history, webhook deliveries, export requests — all customer-only by default. Operators can request a one-shot read of a specific surface within a specific time window; you approve once, the read is recorded with a payload hash written into your custody chain so you can verify exactly what was disclosed.
You see every read, signed and anchored
Every operator-side session — Path A or Path B — produces a signed (Ed25519) and OpenTimestamps-anchored receipt you can download as a PDF and verify against the public key set at https://api.trustvice.com/.well-known/privacy-receipt-keys.json. You can veto an active session in one click; vetoes during legal-override sessions are honored unless the court order itself explicitly prohibits termination (which we surface to you).
Industry-standard fraud detection
We run abuse + fraud detection through industry-recognized external providers under sub-processor contracts that bind them to the same access-discipline floor — never against an in-house heuristic alone, never with model-training rights on customer data. Each provider sees only the envelope it needs (IP, device hash, payment artifact, behavioural signal); none sees workspace contents, audit log content, or agent action content. Every signal raised against your account is visible to you at /app/account/fraud-status — no operator-private subset.
Codified in audit policy 38. Machine-readable disclosure at /.well-known/fraud-providers.json.
Stripe Radar
Payment fraud, chargeback risk, stolen card, velocity. Built into hosted Avonao Billing checkout.
Envelope
Stripe-internal payment object
Sift
Account-level fraud — ATO, fake account creation, payment fraud across providers.
Envelope
Account id (pseudonymous), event type, IP hash, device hash, session id
Castle
Account takeover, impossible travel, credential stuffing.
Envelope
Account id, IP, device fingerprint, user agent
Sardine
KYC + sanctions + PEP signals (Enterprise, customer-consented).
Envelope
Name, DoB, government ID (customer-consented)
Persona
KYC + KYB document verification — Enterprise-tier onboarding only.
Envelope
Document images + selfie liveness (customer-consented)
MaxMind minFraud
IP risk · proxy / VPN / TOR detection · geolocation anomaly.
Envelope
IP address
IPQualityScore
Disposable-email, phone-validation, IP / device fingerprint.
Envelope
Email domain, IP, phone (when provided)
Disputes — SLA per severity
Every signal carries a one-click "Dispute this signal" CTA. We respond within: 24 h for critical · 3 days for high · 7 days for medium · 14 days for low / informational. Resolution writes a custody entry into your workspace; bounded automated actions (lock, step-up, suspend) are reversed when a dispute resolves in your favour.
Customer-controlled authentication
WebAuthn / FIDO2 passkeys
Hardware-bound or platform-bound; enrolled at signup, swappable later. No password, no SMS, no TOTP secret to leak.
Enumerable sessions
Every device + browser session shown with device + IP + location + last-used. Revoke a single session or sign out everywhere with one click.
Recovery codes
Issued once, visible once, stored on your device. Regenerate at any time; old set is invalidated atomically.
Per-action security log
Every passkey enrollment, every session revoke, every recovery-code regenerate is recorded in your account security log — independently of operator-side telemetry.
Agentic API · identity stack
Every action reachable from REST, MCP, ChatGPT Apps, Gemini, Perplexity, Claude Cowork, A2A, NLWeb, or Claude SKILLs rests on a cryptographic identity layer. Customers never type a password to authenticate an agent — they issue the agent its own W3C DID Web identity, bind it to a SPIFFE workload (optional), and grant it explicit authority via an AP2 Verifiable Credential mandate.
Full agentic-API overviewMandates are revocable — and you don’t have to take our word for it. Verify a mandate’s revocation yourself — it reads our published Bitstring Status List in your own browser, no account, no API call to trust.
W3C DID Web Method
did:web:trustvice.com:agents:<id> per agent. Ed25519 (default) or ES256. Customer-rotatable + customer-revocable. Rotation history forms a hash chain (JCS-canonicalised per RFC 8785).
W3C DID Core 1.0 · DID Web Method 0.2 · JWK RFC 7517 + RFC 7638
SPIFFE workload identity
spiffe.trustvice.com trust domain. X.509-SVID or JWT-SVID exchanged for a 5-minute DPoP-bound Trustvice session. Workspace-scoped federation against partner trust domains.
SPIFFE 1.0 · X.509-SVID · JWT-SVID · Trust Bundle + Federation
AP2 Verifiable Credential mandates
Standing authorisation for agent-led billing. Spend cap + invocation cap + per-hour rate + IP CIDR + DPoP thumbprint + step-up factor — every condition enforced at every gateway call. BitstringStatusList revocation refreshed every 5 minutes.
W3C VC Data Model 2.0 · SD-JWT VC · Data Integrity 1.0 · AP2 baseline
MCP Apps ui.iframe
Rich confirmation modals served from ui.tve.world — separate Cloudflare zone, strict CSP, audience-restricted UI session tokens, host-issued nonces echoed in every postMessage reply.
MCP Specification 2025-06-18 · MCP Apps SEP-2025-09
C2PA 2.1 content credentials
Every entpoind.attest.content receipt pairs with a C2PA 2.1 manifest. COSE_Sign1 over deterministic CBOR. DigiCert RFC 3161 timestamp countersign for Pro+ tiers. AI-generated content disclosure auto-injected (EU AI Act Art. 50).
C2PA 2.1 · COSE_Sign1 · RFC 8949 deterministic CBOR · RFC 3161
What we don't do
A list of capabilities Trustvice deliberately doesn't have. Each one is a class of incident we can't cause.
Tops · Spot for Spot
Tops is the parallel ledger that records both what our platform does on your workspace AND what your actors observed and decided. Same chain. Same hash root. Different control models because the trust requirements differ — our actions are always on the record; yours are yours to configure.
Hash-chained, append-only by SQLite trigger, independently verifiable, exportable as a signed JSONL. Included free at every tier — we don't sell it because making it optional would defeat the point.
Infrastructure Tops
Always on. Cannot be disabled.
Every action our platform takes on your workspace. 9 kinds, full detail per kind. You can view, export, and verify; you cannot turn it off. Optional transparency about ourselves isn't transparency.
Target: zero admin reads in normal operation.
Spot Tops
Customer-controlled. Adversary-safe.
What your actors observed, decided, skipped, state-shifted, drifted on. Configure scope hierarchically: per-org default, per-workspace, per-actor. Per-kind toggles, environment filters, sampling, detail level. Defaults to safe (hashes + verdict buckets + reason codes only).
The decision-making process, not just the outcome.
Same chain, both surfaces.
Append-only by SQLite trigger. Merkle-hashable. Notarian-anchorable. The verifier checks both surfaces against the same root hash. Pull the export, run trustvice verify --tops <file>, confirm. The chain breaks detectably if anyone — including us — tampers with an entry.
Decision-making, not just outcomes.
Audit logs say "agent declined the transaction." Tops says the agent saw input pattern X (hash), lens Y fired verdict Z, skipped because reason 0x4 matched, mode transitioned observe → decide → skip. Regulator-grade — EU AI Act Art. 12 / TRAIGA / NIST AI RMF describe the decision-making process, not the result.
Configuration history is itself audited.
Every change to a Spot Tops config writes a tops_config_change entry into the same chain. Disabling Spot Tops for a workspace? That writes an entry too. Upgrading the detail level to forensic? Writes an entry with the prior and new values. You cannot turn off the watcher without leaving a trace of turning it off.
Responsible disclosure
Security researchers acting in good faith and reporting through security@trustvice.com are granted safe harbour from legal action by Trustvice, provided they don't access more data than necessary to demonstrate the issue, don't exploit the issue against other customers, and give us a reasonable period (90 days) to remediate before public disclosure.
Full scope, safe-harbour terms, and response SLAs are published in our Coordinated Disclosure Policy, machine-readable at /.well-known/security.txt (PGP key fingerprint added before public launch).
Trustvice 360