Trundle AI Security & Data Governance Statement
Last updated: June 2026
At Trundle, we believe that your proprietary code, product documentation, and organizational knowledge are your most valuable intellectual assets. This AI Security Statement outlines how we architected our platform to ensure your data is isolated, protected, and never exposed to public machine learning models.
1. The Zero Data Training Guarantee
Our Policy: Trundle enforces a strict, uncompromising zero-training policy. We do not use your source code, repositories, PRDs, tickets, Slack conversations, or Knowledge Base content to train, tune, or optimize any public or proprietary AI models.
Your data belongs entirely to you. It is accessed contextually at runtime exclusively to execute the features you actively trigger.
2. Secure Enterprise AI Infrastructure
Instead of routing user prompts through standard consumer AI endpoints, Trundle isolates all LLM communications through enterprise-tier gateways:
Google Vertex AI Isolation: All core AI interactions with models like Anthropic Claude and Google Gemini run within secured, enterprise-grade Google Vertex AI environments.
Data Retention Controls: Under our enterprise configurations, data sent to these models is not stored or logged by the underlying model providers (Anthropic or Google) for model evaluation or training purposes.
Tracing Observability: We utilize specialized tools like Langfuse to securely monitor prompt latencies, token efficiencies, and error rates, ensuring all debugging logs remain private and strictly constrained to operational analysis.
3. Sandbox Runtime Isolation (AI Dev & QA Workers)
Ephemeral Workspace Spinnups: Every automated QA run or code generation process spins up an isolated, temporary runtime server.
Clean Extraction Logic: Once an AI agent finishes executing commands, running tests, or taking verification screenshots, Trundle extracts only the specific code diff or documentation change required for the ticket branch.
Immediate Teardown: The temporary environment is instantly destroyed. No customer code remains cached or stored inside the worker runtime after the job reaches a final status (Passed, Failed, or Blocked).
4. Code & Document Ingestion Controls
Scoped Integration Tokens: Our integration architectures (such as Google OAuth, Slack, and GitHub) request the minimum viable permissions required to function. We only look at records where Trundle is explicitly authorized or directly mentioned.
Context-Limited Prompts: When extracting data from your uploaded Knowledge Base (like PRDs or call transcripts), Trundle uses secure vector embedding lookups to pass only relevant fragments of information to the AI, minimizing data exposure during complex reasoning tasks.
Encryption Standards: All data traveling between your local environment, the Trundle application, and our enterprise cloud infrastructure is encrypted in transit using TLS 1.3 and at rest using industry-standard AES-256 encryption.
