Security
Last updated: 19 October 2026
Security is central to ChecksTrue. Customers may upload confidential brand assets, internal documents, presentations and marketing material. We design the Service to protect this information and keep each customer workspace isolated.
Contact us about security at support@checkstrue.com.
1. Security approach
ChecksTrue is built around the following security principles:
- Tenant isolation
- Least privilege access
- Private file storage
- Secure authentication
- Two-factor authentication
- Server-side validation
- Configurable file retention
- Auditability
- No use of customer files for AI training
2. Multi-tenant isolation
ChecksTrue is a multi-tenant SaaS application. Each workspace belongs to a company or organization, and customer data is scoped to the customer workspace. Users should only access data for workspaces where they are authorized members. We use database-level access controls and application-level checks to reduce the risk of cross-tenant access.
3. Authentication
Authentication is handled through secure authentication providers. Supported authentication may include email and password, and Google sign in. Passwords are not stored in plain text by ChecksTrue.
Two-factor authentication (TOTP, using any standard authenticator app) is available on every account and can be enabled in Account settings. Workspace owners and administrators — the roles that control Brand Blueprints, team membership and billing — are required to enable it.
4. Authorisation and roles
Workspace permissions are role-based. Typical roles include Owner, Admin and Member. Owners and admins control sensitive actions such as editing Brand Blueprints, managing users, managing subscriptions and changing retention settings.
5. File storage
Uploaded files are stored in private storage and are not publicly accessible. Temporary signed URLs may be used where access is required for processing or user review. Original uploaded files are retained according to workspace retention settings.
6. File retention
Retention is configurable. The default retention period is 90 days unless changed. Users may delete review assets where supported. Review metadata, findings and page previews remain for review history after original files are deleted, until the workspace itself is deleted.
7. AI processing
Uploaded assets may be processed by AI systems to generate review findings. Customer files are not used by ChecksTrue to train AI models. Where commercial AI APIs are used, we rely on provider terms that state API inputs and outputs are not used to train their general models unless separately opted in.
8. Encryption
Data is encrypted in transit using secure connections. Files are stored in private infrastructure with access controls. Secrets and API keys are stored outside the client application.
9. Audit logging
We may log important security and account events, including:
- Sign in and failed sign in
- Brand Blueprint changes
- File uploads
- Review creation
- Team changes
- Subscription changes
- Retention setting changes
Logs are used for security, debugging and abuse prevention.
10. What we do not do
We do not:
- Sell customer files
- Use customer files for advertising
- Use customer files to train our own AI models
- Make customer uploads public
- Intentionally expose one customer’s data to another
- Use customer information to find or approach clients for Druff (section 11)
11. Agency confidentiality and client protection
ChecksTrue was built by the founders of Druff, a creative and digital agency with around 25 years in the industry. We know exactly why an agency hesitates before uploading a client’s brand guidelines to a tool connected to another agency, so we have written the answer down rather than asking you to take it on trust.
- Your client relationships are confidential. Who your clients are, what you upload for them and what the checks find is never used to identify prospects for Druff, to approach your clients, or to pitch creative or digital services to them.
- Your data stays in ChecksTrue’s systems and those of the service providers listed in the Privacy Policy. It is not connected to, copied into or exported to any sales, marketing or customer-relationship system of Druff, and there is no process that does so.
- Access is limited, and support access is recorded. The Service reads your files automatically to check them. The production systems that hold your data can be reached only by the small number of named people who operate ChecksTrue, each protected by two-factor authentication. When one of them opens your workspace in the application to help you, it is through a time-limited support session that is written to your workspace’s audit log, which is included in your data export.
- Your work stays yours. You, and where applicable your clients, keep every right in what you upload. Druff acquires no right to use or reference it, and nothing you upload is used to train AI models.
- It is a contract, not a promise. Section 10 of the Terms of Service binds ChecksTrue and the Druff businesses to these commitments; lists the only exceptions (public information, information obtained without the platform, clients Druff already had, clients who approach Druff unprompted, help you ask for yourself, anonymous aggregate statistics, and what the law requires), with the burden on Druff to show one applies; lasts for two years after you close your account for the non-solicitation promise and for as long as any of your information is held for the rest; and sits outside our liability cap for a deliberate or grossly negligent breach.
The relationship is not hidden: it is stated in the Terms, in the Privacy Policy and here. Read the full commitment in section 10 of the Terms and the plain-language summary in section 8 of the Privacy Policy. Questions before you sign up are welcome at support@checkstrue.com.
12. For your procurement and privacy teams
Our Data Processing Agreement sets out roles, instructions, sub-processors, transfers, breach notification, deletion and audit rights under the GDPR, UK GDPR and POPIA, and is incorporated into the Terms. Workspace owners can export all account data and delete the workspace themselves from the Account page. A countersigned DPA, a completed security questionnaire or a sub-processor change notice can be requested from support@checkstrue.com.
13. Responsible disclosure
If you discover a security vulnerability, contact us immediately at support@checkstrue.com. Please include a description of the issue, steps to reproduce, any affected URLs or accounts, and your contact details.
Do not access, modify or delete data that does not belong to you. Do not publicly disclose vulnerabilities before we have had a reasonable opportunity to investigate and respond.
14. Security limitations
No system is perfectly secure. We continuously improve the Service, but we cannot guarantee that unauthorized access, data loss or security incidents will never occur.
15. Enterprise security
Enterprise customers may request additional security information, including data retention options, sub-processor information, security questionnaires, audit logs, SSO roadmap and custom agreements. Contact support@checkstrue.com.