TrityTrust Privacy Policy

1What TrityTrust does

TrityTrust helps organizations (employers and other customers) verify the education and employment history that candidates give them, with the candidate's consent. It also offers instant background research from public sources, document reading, identity-document checks, and verification of TrityTrust reports by QR code.

2Who this policy covers

• Customers: people who use TrityTrust on behalf of an organization (administrators and requesters).
• Candidates: people whose education or employment an organization asks TrityTrust to verify.
• Visitors: anyone who scans or checks a TrityTrust report.

TrityTrust is not intended for anyone under 18, and we do not knowingly verify or collect data about minors.

3Data we collect

3.1 Account data (customers)

• Email address, password (stored only as a one-way hash), optional full name and profile photo, preferred language.
• The organization you belong to and your role in it.
• Sign-in records: the device type/browser, IP address and time of each session.

3.2 Candidate data (entered by a customer or by the candidate)

• Full name (in English and optionally Amharic), date of birth if provided (it is optional and may be just a year), email address and phone number.
• The education or employment claimed: institution or employer, qualification or job title, field of study, dates.
• The candidate's consent record, documents the candidate uploads, the evidence gathered from the institution or employer, and the resulting verification report.

3.3 Data you choose to process in the app

• Camera and photos: used only when you scan a QR code or photograph a document. The text of a document is read on your device; the photo itself is not uploaded or stored by TrityTrust.
• Document text: the text read from a certificate, letter or identity document is sent to our servers to extract the details you need. It is not stored after it has been processed.
• Background research: the name (and, if you provide them, year of birth, country, institution or employer) of the person you research, and the research result.
• QR links: the address contained in a QR code you scan.

3.4 Records we keep for security and accountability

• An audit log of important actions (for example, sign-ins, requests created, reports downloaded). The audit log records who did what and when; it does not contain document contents or research names.

4How we use data

• To provide the service: run verification requests, manage organizations and team members, produce and verify reports, read documents, and run background research when you ask for it.
• To keep accounts secure: authentication, preventing abuse, detecting misuse of sign-in tokens.
• To meet legal and contractual obligations, including keeping records of consent and of how each verification was decided.
• To communicate with you about your account and requests (for example, invitations and password resets).

Verification outcomes are always decided by people. Automated tools and AI help read documents and summarize public information, but they never mark anything as "Confirmed".

5Consent for candidates

A candidate's education and employment are verified only after the candidate consents. Candidates can see the purpose of the check and the data involved, and can withdraw consent; withdrawing stops further checks. Customers using background research must confirm that the person agreed to be checked.

6Services we share data with

We share only what each service needs:

• Institutions and employers named in a request, to confirm the claimed education or employment.
• Hosting: our servers run on Microsoft Azure.
• AI processing (only when the feature is used): Cloudflare Workers AI and OpenRouter receive the text needed for the task — names of institutions or employers, the text of non-sensitive documents (certificates, letters) when you allow AI help, and public web results to summarize. Identity documents are never sent to an AI service.
• Web search for background research: Tavily receives the searched name and the context you provided.
• Public lists: names are matched against the official sanctions lists of the United States (OFAC), the United Nations Security Council, the European Union and the United Kingdom, which we store and search on our own servers, and against the FBI's public wanted list.
• QR link safety: the domain of a scanned link is looked up in public domain-registration records (RDAP) and, where enabled, in abuse.ch URLhaus and Google Safe Browsing. TrityTrust never opens the scanned link itself.
• Email delivery: our email provider, to send account and request messages.

These providers process data on our behalf or as independent public services. Some are located outside Ethiopia; we transfer only the data needed for the task.

7How long we keep data

• Candidate uploads: 30 days after the verification no longer needs them.
• Verification evidence, reports and audit records: up to 7 years, because organizations and regulators may need to rely on them.
• Notifications: 1 year.
• Inactive accounts: 2 years.
• Mobile sign-in: you stay signed in until 90 days without using the app, or until you sign out.
• Document text and identity-document data: not stored after processing.
• Background research results: kept for your organization until it deletes its account or asks us to delete them.

Data under a legal hold is kept until the hold is released.

8Security

• All connections are encrypted (HTTPS/TLS).
• Passwords are stored only as strong one-way hashes (Argon2id).
• Dates of birth, phone numbers and identity numbers are encrypted in our database.
• Sign-in tokens are random, stored only as hashes, and can be revoked at any time.
• Organizations can only see their own data; this is enforced in the application and in the database.
• Access by TrityTrust staff is limited by role, recorded, and reviewed.

9Your rights

Under Ethiopia's Personal Data Protection Proclamation No. 1321/2024 and other applicable laws, you can ask to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your data (subject to records we must keep by law);
• object to or restrict certain processing;
• withdraw consent you have given.

Customers can delete their account at any time in the app (Profile > Edit profile > Delete account). Candidates can manage their data and consent in the candidate portal. For any other request, email admin.tritytrust@ttechnos.com. We may need to confirm your identity before acting on a request.

10Changes to this policy

We will update this policy when our practices change and show the new effective date at the top. Significant changes will be announced in the app or by email.

11Contact

Questions or complaints: tessemat@ttechnos.com

You also have the right to complain to the competent data protection authority in Ethiopia.