Truss Software Inc. ("Truss", "we", "us") provides a service that processes confidential financial and real estate data for institutional investors, owners and operators. This policy explains what information we collect through the Truss service (the "Service") and the website at https://truss.re (the "Website"), how we use and protect it, and the service providers that process it. Capitalized terms not defined here have the meanings in our Terms & Conditions.
Truss plays two roles:
- For Customer Data, the data our customers submit to the Service, Truss processes data on the customer's behalf and only on its instructions. The customer decides what the data is and how it is used.
- For information about our users and website visitors, such as names, email addresses and sign-in records, Truss decides how it is used, as this policy describes.
1. Customer Data
- Truss never sells, rents or shares Customer Data with anyone.
- Truss uses Customer Data only to provide, secure and support the Service for the customer that submitted it. It is never made available to another customer, and never used for advertising or marketing.
- Customer Data is processed only by Truss and by the service providers listed in section 4, which host and operate the Service for us under written confidentiality and security obligations.
- Truss discloses Customer Data to a government or court only when the law compels it, discloses only what is required, and, where the law allows, notifies the customer first.
- Customer Data can contain personal information, such as the names of tenants or contacts in a rent roll. If your personal information is in a customer's data, contact that customer; Truss will help it respond.
2. Information We Collect
When you use the Service
- Account information: your name, work email address and organization. Our sign-in provider records when you sign in, and the Service keeps you signed in with a session cookie.
- Activity records: which user created, changed or archived an item, such as an upload or a report, and when.
- Error reports: when something fails, a technical report of the error, which can include your user ID and email address and the names of the files, properties or reports involved.
When you visit the Website
- The Website sets no cookies of its own and uses no analytics or advertising trackers.
- Our hosting provider receives your IP address and browser information in order to serve the pages, and your browser loads fonts from Google Fonts, which also receives your IP address.
- The demo booking calendar on the demo page and at the end of each article is provided by Calendly. Calendly sets its own cookies, asks for your consent to them, and receives the details you enter to book a meeting.
When you contact us
Your name, email address, company and whatever you choose to tell us when you email us or book a demo.
3. How We Use Information
- To provide, secure and support the Service, including signing you in and finding and fixing errors.
- To respond to you, hold the demos you book, and send notices about the Service, its security and your account.
- To send business contacts occasional emails about Truss. You can opt out of these at any time by replying or by emailing security@truss.re.
- To comply with the law and enforce our agreements.
Truss does not sell personal information, does not share it for targeted advertising, and does not use it to build advertising profiles.
4. Service Providers
These providers process information for Truss, each only to provide its service to us:
- Microsoft Azure (Microsoft Corporation): hosting, databases, file storage and backups for the Service, in data centers in the United States. Customer Data, account information.
- ARGUS Cloud (Altus Group): runs ARGUS Enterprise calculations on customers' ARGUS models, in Truss's own ARGUS account, to produce the outputs the Service reads. Customer Data.
- Dropbox (Dropbox, Inc.): file storage used by Truss's ARGUS processing. Customer Data.
- Sentry (Functional Software, Inc.): error monitoring, in its United States region. Error reports.
- WorkOS (WorkOS, Inc.): sign-in, emailed sign-in codes and single sign-on. Account information.
- Google Workspace (Google LLC): Truss's email. Messages you send us.
- Calendly (Calendly LLC): demo booking on the Website. Details you enter to book.
- Google Fonts (Google LLC): fonts on the Website. Your IP address.
The Service also reads from and writes to systems a customer chooses to connect, such as SharePoint, Dropbox, Box, Egnyte, MRI or Yardi. Those are the customer's own accounts, used on its instructions.
5. Security
- Independent audit. Truss's controls are audited under SOC 2 Type 2 by Sensiba, an independent CPA firm, and monitored with Drata.
- Encryption. Data is encrypted in transit with TLS and at rest with AES-256.
- Location. Truss stores Customer Data in Microsoft Azure data centers in the United States.
- Separation. Each customer's data is kept separate: a customer's users can reach only that customer's data.
- Access. Access to Customer Data is limited to Truss personnel who need it to operate and support the Service.
- Backups. Data is backed up regularly and automatically; backups are encrypted and kept in the United States.
If Truss confirms a breach of security that leads to unauthorized access to, or loss, alteration or disclosure of, a customer's data, Truss will notify the affected customer without undue delay, and in any case within 72 hours of confirming it, and will notify individuals where the law requires.
6. Retention
- Account information is kept while your account is active and as needed afterwards to meet legal obligations and resolve disputes.
- Customer Data is kept as the customer's agreement with Truss provides; copies in backups expire on the backup schedule.
- Correspondence and demo bookings are kept as long as they are useful to the business relationship.
7. Your Choices and Rights
You can ask to access, correct or delete the personal information Truss holds about you, or to stop receiving emails about Truss, by writing to security@truss.re. Depending on where you live, the law may give you further rights over your personal information; we will honor them as it requires. We will not treat you differently for exercising them.
8. Where Information Is Processed
Truss is based in the United States, and the Service stores data in the United States. If you contact us or use the Website from elsewhere, your information is transferred to and processed in the United States.
9. Children
The Service and the Website are for businesses and are not directed to anyone under 18. We do not knowingly collect personal information from children.
10. Changes to This Policy
We will post any change to this policy on this page and update its effective date. If a change is material, we will tell customers by email or with a notice on the Website before it takes effect.
11. Contact
Questions about this policy or our security: Truss Software Inc. — security@truss.re