Trellis

Security at Trellis

Defense suppliers trust us with their vendors, parts and origin records. Here is how we protect them, and where the limits are today.

What Trellis isn't approved for yet

Trellis hasn't been assessed for CMMC Level 2 and isn't FedRAMP authorized, so it isn't approved for Controlled Unclassified Information (CUI) or ITAR technical data. Keep drawings, specifications and other controlled technical data in your compliant environment. Trellis is built for the records around them: part numbers, lots, certs, vendors, screening results and origin declarations.

Your data is separate from every other customer's

  • Every record in Trellis belongs to one organization, and every page and API route checks that the record belongs to the signed-in user's organization before returning or changing it.
  • We run automated tests that sign in as one company and try to read or change another company's records through every route in the app and the public API. Every attempt has to be refused, and a new route can't pass the tests until it's covered.
  • The supplier portal has its own tests: a supplier can't see another supplier's records, another buyer's, or a purchase order or contract that hasn't been sent to them.

Access inside your organization

  • Admins decide which modules each member can use. A member without a module can't open its pages or call its API routes.
  • Approver roles for purchase orders, work orders and contracts are granted per member, and only to members who have that module.
  • Team, permission and security changes are recorded in your activity log, and so are document downloads, data exports and API key use, so admins can see who looked at what.
  • Owners get an email when one member downloads or exports far more than usual in an hour, and whenever anyone exports all of the organization's data.
  • API keys act as the member who created them. Removing a member revokes their keys, and a key stops working if its creator is no longer in your organization.
  • Each API key can be limited to read-only access, to specific modules, to a list of IP addresses, and to an expiry date. Webhook signing secrets can be replaced at any time.

Sign-in

  • Passwords are stored only as bcrypt hashes. Five failed attempts in a row, whether a wrong password or a wrong two-factor code, lock the account for 15 minutes and email you.
  • Two-factor authentication with an authenticator app, plus single-use backup codes. Admins can require it for everyone in the organization. Two-factor secrets are encrypted in the database.
  • Creating an API key or webhook, making someone an admin, turning off the two-factor requirement or the US-only restriction, or granting a travel exception asks you to confirm your password or a two-factor code unless you signed in within the last 10 minutes.
  • Sessions last at most 7 days. Settings lists every device you're signed in on, and you can sign out any one of them. Changing or resetting your password, turning off two-factor, or choosing “sign out of all devices” ends every other session right away.
  • Team invite links are stored only as hashes, like password reset links, so a copy of our database couldn't be used to join your organization.
  • Password reset links work once and expire after an hour.
  • Account owners get an email when a password changes, two-factor is turned on or off, the account is locked, or a new API key is created.
  • You can also sign in with Google instead of a password.
  • Single sign-on: organizations can connect Okta, Microsoft Entra ID, Google Workspace, ADFS or another provider over OpenID Connect or SAML 2.0, so their own provider handles passwords and MFA. Admins first prove they own their email domain with a DNS record, and can then require SSO for everyone on it.

Location and export controls

  • Admins can restrict their organization to the United States. Sign-in, the dashboard and API keys then only work from the US and its territories, based on the connection's IP address. Refused sign-ins and API key calls are recorded in your activity log, and we're alerted to repeated ones.
  • Only admins can turn the restriction on or off, or grant a travel exception. An exception covers one member, one country and at most 90 days, can be revoked at any time, and never extends to API keys. Every change is recorded in your activity log.
  • Purchase orders can be marked export-controlled. Trellis won't send one to a vendor outside the US, or to one with no country on file, until an admin records the export license, agreement or exemption that covers it. Stopped attempts are recorded too.
  • A vendor's country is locked once the vendor is created. Only an admin can change it, and only by uploading a document that supports the new country. The document stays with the change, and the change is recorded in your activity log.
  • IP location can be changed with a VPN, so these controls support your export-compliance program rather than replace it.

Suppliers and counterparties

  • Suppliers you invite sign in to the portal with single-use links that expire. They don't get a Trellis account or see anything you haven't sent them.
  • Suppliers can use the portal from anywhere. Each portal sign-in, and each purchase order, contract or origin request a supplier opens, is recorded in your activity log with the country it came from.
  • An export-controlled purchase order shows its details in the portal only to connections from the US, unless you've recorded an export authorization for it.

Infrastructure

  • All traffic is HTTPS, and browsers are told to always use it (HSTS).
  • A strict Content Security Policy only lets pages load scripts and connect to our own site. Trellis pages can't be framed by other sites.
  • The app runs on Vercel, in the US (Cleveland), next to the database. The database runs on Neon, on AWS in the US East region, and Neon encrypts it at rest. Uploaded and generated documents are kept in private storage and are only served to members of the organization they belong to.
  • Uploaded files are checked for type and size, and are never served as web pages in our domain.
  • Card payments go straight to Stripe. We never see or store card numbers.
  • The full list of services that handle your data is in our privacy policy. Documents you send to auto-fill are processed by Anthropic and aren't used to train their models. Admins can turn auto-fill off for the whole organization, and then documents are never sent.

Your data stays yours

  • You can export each module's records to CSV at any time, or everything at once as a ZIP.
  • If your subscription ends, your data stays readable. You just can't make changes until you resubscribe.
  • Admins can delete the organization from Settings. That permanently removes every record, document and API key, cancels the subscription, and deletes logins that belong only to your organization. Database backups roll off within 30 days.
  • To have a single account deleted, or for help with either, email hello@buildontrellis.com.

Report a security issue

If you think you've found a vulnerability, email hello@buildontrellis.com with the details. Please don't access other customers' data or disrupt the service while testing. Security questionnaires from your customers or primes are welcome at the same address.