Most trust pages hand you a wall of logos. We do not have those logos yet, and we will not pretend to. Instead, here is every mechanism that guards your data, each written to be verified, and one honest line about the badge we have not earned.
Generated from the configuration we are actually running: what each path checks, what it measured, and where a measurement no longer describes the live system.
What we never do, what stands guard right now, and what you control. In plain words.
The exact path a request takes, which providers can see it, and the no-training guarantee.
Our benchmarks with the methodology and the negative results. We publish when we are wrong.
The plain-language agreement. No dark corners.
We are a small company. Claiming a SOC 2 report we do not hold would be the first untrustworthy thing on a trust page. So we do not. What we offer instead is the set of mechanisms an auditor would look for, stated concretely and checkable today:
When we do pursue a formal report, we will say so here, with the date we started and the date we finished. Not before.
The security and privacy pages above. Per-request metering you can see. Invite-only, opt-in from the first touch. A real person answers [email protected].
A named data-retention policy. A subprocessors list (who else can touch a request). One-click data export. One-click deletion. Each one only reduces what we hold or shows you what we already do.
Every claim linked from this page is written to be checkable. Email [email protected] and ask how any of it works — a real person answers, and if we get something wrong we say so in public. Last week we caught our own best benchmark result being false and published the finding the same day. That is the standard we hold ourselves to, so you can imagine how we treat your data.
Pre-beta honesty: Tīrtha is small. We would rather earn trust slowly with mechanisms you can check than quickly with badges we have not earned. · Security · Privacy · Back to overview