Security at Trezio

1. Security Philosophy

Trezio's security model is built around one core idea: the things you'd least want exposed in a breach — your saved passwords — should be unreadable to us even if our servers were fully compromised. That protection is real and specific: it applies to vault credentials, not to your entire library. Ordinary bookmarks, notes, and screenshots are protected by account isolation and access control (below), not by end-to-end encryption.

2. Account and Session Protection

Authentication is handled by Supabase Auth. Every request to load or modify your data requires a valid session token; all traffic between your device and Trezio's servers is encrypted in transit via HTTPS/TLS.

• Session storage: your authentication token is stored locally on your device (browser local storage for the web app and extension) and is required for every API call.
• Password changes: your account password and your vault master password are entirely separate — changing one never affects the other.

3. Database-Level Data Isolation

Every table in Trezio's database enforces Row-Level Security (RLS) — a Postgres feature that restricts which rows a request can see or modify, checked by the database itself rather than trusted to application code:

CREATE POLICY "Users can only access their own items"
  ON items
  FOR ALL
  USING (user_id = auth.uid());

Free-tier plan limits (100 items, 5 folders, 1 secure vault) are enforced the same way — at the database level, independent of the client application — so they apply consistently no matter which client (web, extension, or mobile) is used.

4. Vault and Credential Protection

Credentials you store in your vault use a zero-knowledge encryption model: Trezio's servers never see your master password and cannot decrypt your stored credentials, even under legal compulsion, because the decryption key never leaves your device.

Master password requirements

• Minimum 8 characters, at least one uppercase letter and one number (special characters recommended, not enforced)

Auto-lock

• Web app: vault locks automatically after 30 minutes of inactivity (tracked via mouse, keyboard, scroll, and touch activity)
• Browser extension: session-based — the vault re-locks whenever the browser session ends

Vault folders

Separate from credential encryption, an entire folder can also be password-protected. That folder password is hashed with bcrypt (cost factor 10) before storage — it gates access to the folder, not the credential encryption itself.

5. Backup and Data Portability

Your data stays portable.

Export your library as a versioned JSON backup, with HTML and CSV formats available for compatible bookmark workflows. The JSON backup is the format designed to be restored back into Trezio; HTML and CSV are provided for compatibility with other bookmark tools (Raindrop.io, Chrome, Firefox), not as restore-guaranteed backups.

• Vault credentials are never included in any export format.
• Voice-note and screenshot content is exported as a reference to where the file lives in storage, not as an embedded copy of the file itself.
• Restoring a backup processes your items in batches; if a batch is retried, Trezio's import logic is designed to avoid creating duplicates for that batch, but a restore is not currently an all-or-nothing operation.

6. Data Ownership and Deletion

• You own your content. Trezio stores, processes, and displays it solely to provide the Service to you.
• Soft delete: items moved to trash are recoverable for 30 days before permanent deletion.
• Account deletion: deleting your account (in-app, or by emailing support from your account email) permanently removes all associated data from our servers within 30 days.
• Regional rights: depending on your location, you may have additional rights under GDPR (EU/EEA) or CCPA (California), including access, correction, deletion, and data portability. Trezio does not sell personal data.

7. Infrastructure and Operational Safeguards

Trezio's infrastructure provider, Supabase, independently holds its own SOC 2 Type II certification for its platform. This describes Supabase's certification of its own infrastructure — Trezio does not separately hold this or any other independent security certification today (see Honest Limitations, below).

8. Responsible Disclosure

If you believe you've found a security vulnerability in Trezio, we want to hear from you directly rather than through public disclosure first.

• Contact: security@trezio.app
• Our commitment: we will acknowledge your report and work with you on a reasonable disclosure timeline once a fix is in place, rather than asking you to wait on an arbitrary schedule.

9. Honest Limitations

We'd rather state these plainly than let a confident-sounding page imply otherwise:

• Trezio has not completed an independent, third-party security audit or penetration test to date.
• There is no live bug bounty program today.
• Trezio itself does not hold SOC 2 or any other independent compliance certification — only its infrastructure vendor (Supabase) does, for its own platform.
• Encryption is scoped to vault credentials specifically. Ordinary bookmarks and notes rely on account isolation (RLS) and transport encryption (HTTPS/TLS), not end-to-end encryption.
• Backup restores are idempotent per retry but are not yet a single all-or-nothing transaction.

Contact

For any other question about how Trezio protects your data: