Last updated · Mar 1, 2026

Privacy Policy

This policy explains what data Triago collects, how we use it, and the rights you have. It applies to triago.com and to the Triago Service.

Data we collect

• Account data — name, work email, role, organization.
• Telemetry — product usage events, with PII minimized.
• Customer data — alerts, logs, and artifacts ingested via your authorized connectors.
• Inference data — prompts, model outputs, and traces necessary to produce verdicts.

How we use it

We use data to operate, secure, and improve the Service. We do not sell customer data. We do not train foundation models on customer data unless you opt in (federated fine-tuning, never raw data).

Subprocessors

We use a documented list of subprocessors — current list available at triago.com/subprocessors. Customers receive 30 days' notice of additions on Enterprise.

Data residency

Customers can pin to US, EU, UK, AU, or JP regions. Cross-region replication is disabled unless explicitly requested.

Your rights

You may access, correct, delete, or export your account data. For customer data, your administrator is the data controller and can use Triago's APIs to fulfill data-subject requests.

Retention

Audit logs are retained for the term plus 90 days, or longer if law requires. Customer data is deleted within 30 days of termination, with documented exceptions for legal holds.

Security

See our Trust Center for certifications, architecture, and disclosure paths.

Contact

Privacy questions: privacy@triago.com. EU representative on request.