Security at Trovo

Your project information, contact details, and conversations are sensitive. This page outlines the practical steps we take to keep them safe.

Encryption

• In transit: all connections to trovohome.com and our APIs use HTTPS (TLS 1.2 or higher). HTTP is automatically redirected.
• At rest: our database (Supabase Postgres) is encrypted using industry-standard AES-256.
• Backups: Supabase performs automated encrypted backups; we use them only for disaster recovery.

Authentication

• We use Supabase Auth, which stores passwords using bcrypt-based hashing — we never see your plaintext password.
• Sessions use signed JWTs with a short lifetime and are stored in your browser's local storage.
• Password resets go through email-based verification with single-use tokens.

Authorization

• Database access is governed by Postgres Row Level Security policies — homeowners only see their own projects, messages, and matches; contractors only see projects matched to them.
• Server-side code paths that need elevated access run through dedicated, narrowly scoped backend endpoints.

Infrastructure

• Web hosting: Netlify (with HTTPS, automatic certificate renewal, and edge caching).
• Database & auth: Supabase (managed Postgres with row-level security).
• Notifications & API backend: Render (containerized service with HTTPS).
• AI assistant: Anthropic (Claude). We send only the minimum context needed and Anthropic does not use Trovo data to train models under our agreement.

Operational practices

• Production data access is limited to a small set of authorized team members with named credentials.
• Service-role API keys are stored in environment variables, never committed to source control, and rotated when team members leave.
• Source code is hosted on GitHub with branch protection and review.
• We log application events for debugging and security analysis. Logs are retained for a limited time.

What we don't do

• We do not sell, rent, or share your personal data with advertisers or data brokers.
• We do not store payment card information — Trovo's matching service is free, and any contractor payment happens directly between you and the contractor.

Your role

• Use a strong, unique password for your account.
• Don't share your password or session links.
• Sign out from shared computers.
• If you receive a suspicious message claiming to be from Trovo, do not click links — forward it to hello@trovohome.com.

Reporting a vulnerability

We welcome reports from security researchers and other good-faith reporters. To report a vulnerability:

• Email hello@trovohome.com with subject "Security report."
• Include enough detail for us to reproduce and assess the issue.
• Please give us a reasonable window (typically 90 days) to resolve before public disclosure.

We don't currently run a paid bug bounty program but will publicly thank researchers who report responsibly (with your permission).

Contact

Trovo
Email: hello@trovohome.com
Phone: +1 (857) 524-2867
Boston, MA