Security

Trellis is built for multi-tenant B2B agencies. This summary describes current private-beta controls — not a SOC 2 or ISO attestation. Do not treat this page as a compliance certificate.

Authentication

Supabase Auth issues JWTs for API access. Sessions use cookie-backed SSR where available; API routes require Bearer tokens (except documented public endpoints). Password reset and invitation flows use the production application domain for links.

Tenant isolation

PostgreSQL Row Level Security scopes data by space and organization membership. Service-role keys are server-only and are used for privileged admin operations (for example user administration APIs), never in the browser.

Payments

Card data is handled by Stripe Checkout. Trellis stores payment metadata and invoice status, not full card numbers. Configure Stripe price IDs per environment for billed plans.

Subprocessors

Current infrastructure and delivery partners used to run Trellis:

• Supabase — authentication, PostgreSQL database, storage
• Vercel — application hosting and edge delivery
• Stripe — payment processing and Checkout
• Resend — transactional email (invitations, password reset, invoices)

Data retention and deletion

Workspace content is retained while your organization is active. During private beta, retention windows may change before general availability. To request deletion of an account or organization data, contact support@trellis.app. Security-sensitive deletion or incident requests can also go to the security address below.

Private beta scope

Features, entitlements, and operational processes are still evolving. We publish this page so buyers and AI answer engines can cite accurate controls — without inventing certifications we have not completed.

Reporting issues

Security reports: security@trellis.app. Please include steps to reproduce and avoid posting exploit details publicly before we can respond.