1. Our Approach
TrueMend's core analysis runs locally, on your own infrastructure, with no network call at all unless you use a licensed or account-connected feature. That is a security property, not only a convenience: most of the product has no server-side attack surface to speak of, because most of the product never talks to a server. This page covers the parts that do.
2. Infrastructure
- Hosting. The website and API run on Vercel. Authentication, the database, and file storage run on Supabase.
- Encryption in transit. All traffic to and from truemend.ai is served over HTTPS/TLS.
- Encryption at rest. Data is encrypted at rest by our infrastructure providers' native mechanisms.
- Access control. Internal access to production data is restricted to authorized personnel. Our billing integration uses a service-role database client only where required for webhook-driven writes (subscription and license state); ordinary account operations use a scoped, non-privileged client.
- License signing. License keys are signed with RSA-2048. Private signing keys are kept out of version control and are never bundled into any distributed binary; only the corresponding public key is embedded for verification.
3. Application Security Practices
- No cookies. Authentication uses a bearer token in browser local storage, not a cookie. See our Privacy Policy for the tradeoff this carries and what it means for you.
- Secrets redaction before any LLM transmission. The one flow where code leaves your infrastructure by design (the opt-in
--ci --batchflag) runs automatic redaction for API keys, tokens, AWS credentials, JSON web tokens, and password-like strings before anything is sent. See our Responsible AI Policy for the full detail. - Post-transform verification. Every deterministic fix is re-parsed after being applied and rejected if it produces invalid syntax, with the original file restored automatically on failure.
- No secrets in the demo. The in-browser Playground analyzes submitted code in-request and stores none of it.
- License validation is offline-capable and cryptographically signed, so an air-gapped environment is never forced to trust a live network call.
4. Third-Party Security
We rely on established providers for the parts of the stack they specialize in, rather than reimplementing payment or auth security ourselves: Stripe for payment processing (Stripe is a PCI-DSS Level 1 certified payment processor in its own right; we never receive or store raw card data), Supabase for authentication and database hosting, and Vercel for hosting. Each maintains its own security practices and certifications; see their respective security documentation for detail beyond what we control.
5. Certifications
We do not currently hold SOC2, ISO 27001, or any other third-party security certification. We say this plainly rather than let a compliance feature imply otherwise: TrueMend the product includes a compliance command that checks a customer's own codebase against frameworks including SOC2, ISO 27001, OWASP, HIPAA, PCI-DSS, GDPR, the EU AI Act, the NIST AI RMF, and ISO 42001. That is a feature we offer you, not a claim about ourselves. If a third-party certification becomes relevant to your procurement process, contact us; we will tell you honestly where we stand at the time you ask.
6. Data Handling
Full detail on what we collect, what we explicitly do not, and who we share it with is in our Privacy Policy. In short: your source code never reaches our servers except through the one opt-in flow described in Section 3, and we do not sell data to anyone.
7. Incident Response
If we confirm a security incident affecting your data, we will notify affected account holders without undue delay, consistent with our legal notification obligations, and describe what happened, what data was involved, and what we are doing about it.
8. Reporting a Vulnerability
Do not open a public GitHub issue for a security vulnerability. Email hello@truemend.ai instead, with: a description of the vulnerability and the affected component, steps to reproduce (proof-of-concept if you have one), the potential impact, and your preferred contact for acknowledgment.
We will acknowledge receipt within 2 business days and aim to give an initial assessment within 5 business days. We ask for a 90-day coordinated disclosure window from the date of acknowledgment, and will communicate our remediation timeline within the first 14 days.
Update timelines once a report is validated:
- Critical (remote code execution, secrets exfiltration): patched and released within 7 days.
- High (local privilege escalation, authentication bypass): patched within 30 days.
- Medium: addressed in the next scheduled release.
- Low: addressed at our discretion.
In scope: path traversal or arbitrary file read/write via any TrueMend command or MCP tool; command injection via any subprocess call; license validation bypass; secrets exfiltration via the Batch API or MCP server; prompt injection leading to unintended file modifications; privilege escalation via the distributed binary or Docker container; and vulnerabilities in the truemend.ai website, API, or account/billing flows.
Out of scope: vulnerabilities requiring physical access to your machine; vulnerabilities in Anthropic's, Stripe's, Supabase's, or Vercel's own infrastructure (report those to them directly); social engineering; issues in dependencies with no upstream fix available; and theoretical attacks with no practical exploit path.
Safe harbor. If you make a good-faith effort to comply with this policy during your research, including staying within the scope above and reporting privately rather than exploiting or publicly disclosing a vulnerability before we have addressed it, we will not pursue legal action against you for that research, and we will consider your access authorized for the purposes of applicable computer-abuse laws. This safe harbor does not extend to activity outside this policy's scope.
We thank security researchers who disclose responsibly. With your consent, a confirmed in-scope report is acknowledged in the release notes for the fix.
9. Changes to This Policy
We will notify active account holders of material changes by email at least 30 days before they take effect. The current version is always at truemend.ai/security.
10. Contact
2435316 Ontario Inc., operating as TrueMend, Ontario, Canada.