Trust & DPA

• Read-only cloud access. For AWS you create a read-only IAM role that we assume with your company’s own External ID. We never ask for cloud passwords or long-lived keys, and you can revoke access by deleting the role.
• A narrow platform identity. Omni FinOps’ own AWS identity can only assume that role, read the public AWS price list, and serve the role template.
• Hashed secrets. Passwords are stored as salted scrypt hashes. Session tokens and emailed verification and reset links are stored only as hashes, and links expire and work once.
• Verified accounts and bot protection. Every account verifies its email address before using the service. Cloudflare Turnstile checks sign-ups, password resets and administrator sign-ins for bots, and accounts lock after repeated failed sign-ins.
• Encrypted traffic, closed origin. All traffic runs over TLS through Cloudflare. Our servers reach Cloudflare through an outbound tunnel, so the app has no open inbound ports, and the database isn’t reachable from the internet.
• Backups. The database is backed up every day, encrypted, and stored off-site in Amazon S3 in Trillo.CR’s own AWS account, versioned. Each backup is deleted after 30 days.
• Your controls. You can export a company’s data as JSON, and erase or delete it, at any time from Company settings.
• Email limits. Alert email is capped per company and per server, and recipients always come from your saved settings, so the service can’t be used to relay arbitrary mail.
• Limited internal access. Only Trillo.CR’s administrator can open our internal console, which shows account details and support tickets. To fix a problem, the administrator can open an account from it and see it as its owner does, cloud figures included; each time is logged and ends after an hour.

These providers process data for us. Each one gets only what it needs.

The service and its database run on servers Trillo.CR operates in Costa Rica. Your connected clouds’ own providers handle data under your agreement with them.

We’ll give at least 30 days’ notice, by email or in the app, before adding or replacing a subprocessor that handles Customer Data. If you object on reasonable data protection grounds, tell us at [email protected] and we’ll work with you on a solution. If there isn’t one, you can cancel before the change takes effect.

This DPA forms part of the Terms of Service between Trillo.CR and a business customer (“Customer”). It applies whenever Trillo.CR processes personal data in Customer Data on Customer’s behalf. If it conflicts with the Terms on data protection, this DPA wins.

1. Roles. Customer is the controller and Trillo.CR the processor of Customer Data: the data the service reads from Customer’s connected cloud accounts (costs, credits, invoices, resource inventory and its tags, inventory changes and usage metrics), and the names and email addresses Customer adds, such as alert recipients, comments and their authors. Trillo.CR is the controller of account and billing data (users’ names, emails and sign-in data), which our Privacy Policy governs.

2. Subject matter, duration, nature and purpose. Trillo.CR processes Customer Data to provide Omni FinOps: reading it, storing it, analyzing it, and showing and emailing the results to Customer. Processing lasts for the term of the Terms plus the deletion period in section 9.

3. Data and data subjects. Personal data in Customer Data is limited to what Customer’s cloud accounts and users contain: typically names, email addresses or usernames in resource tags, names and emails of Customer’s team members and alert recipients, and cloud account names. Data subjects are Customer’s employees, contractors and other people named in that data. The service isn’t designed for sensitive data, and the Acceptable Use Policy asks Customer not to put it there.

4. Instructions. Trillo.CR processes Customer Data only on Customer’s documented instructions: the Terms, this DPA and Customer’s use and configuration of the service. If Trillo.CR believes an instruction breaks data protection law, it will tell Customer. If the law requires other processing, Trillo.CR will tell Customer first unless the law forbids it.

5. Confidentiality. Everyone Trillo.CR authorizes to process Customer Data is bound by confidentiality and accesses it only as needed to provide and support the service.

6. Security. Trillo.CR keeps appropriate technical and organizational measures in place, including those under Security practices above, and may improve them over time without lowering the overall level of protection.

7. Subprocessors. Customer authorizes the subprocessors listed above. Trillo.CR binds each one by written terms that protect Customer Data at least as well as this DPA, remains responsible for them, and follows the notice and objection process in Subprocessors.

8. Assistance and breaches. Trillo.CR helps Customer, taking into account the nature of the processing, to answer data subjects’ requests, and with security, impact assessments and consultations with authorities. Much of this is self-serve: export, erase and delete in Company settings. Trillo.CR notifies Customer without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting Customer Data, with the information Customer needs to meet its own obligations, and keeps Customer updated as it learns more.

9. Return and deletion. Customer can export Customer Data at any time. When the Terms end or Customer asks, Trillo.CR deletes Customer Data within 30 days, except what the law requires it to keep. Backups age out within 30 days.

10. Audits. Trillo.CR makes available the information reasonably needed to show compliance with this DPA, including this page and answers to reasonable security questionnaires, once a year or after a breach. On-site audits happen only where the law requires them, with reasonable notice, at Customer’s cost, and under confidentiality.

11. International transfers. The service runs in Costa Rica, and some subprocessors are in the United States and Switzerland. Where the GDPR or UK GDPR apply to a transfer, the parties rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum), which are incorporated by reference.

12. Laws. Trillo.CR processes Customer Data in line with Costa Rica’s Law 8968 on the protection of personal data and, where they apply, the GDPR, the UK GDPR and US state privacy laws. Under the CCPA/CPRA and similar laws, Trillo.CR acts as Customer’s service provider: it doesn’t sell or share Customer Data, use it for any purpose other than providing the service, or combine it with other data except as those laws allow.

13. Liability and law. The limits of liability and the governing law and courts in the Terms apply to this DPA, except where data protection law doesn’t allow it.

This DPA applies automatically to business customers. For a countersigned copy, email [email protected] with your company’s legal name and address.

If you find a vulnerability or suspect a breach, email [email protected] with as much detail as you can. Please give us reasonable time to fix it before telling others, and don’t access other customers’ data or disrupt the service while testing. Never include passwords or secret keys in your report.