Trust center
Security
Truffle treats browsers, external services, files, and service responses as untrusted input. Access is decided by server-side identity, role, channel membership, and fresh authorization.
Accounts & Sensitive Actions
- Passwords are processed with Argon2id and are never stored in plain text.
- Browser sessions use opaque secure cookies and same-origin request protection.
- Passkeys and fresh step-up checks can protect sensitive actions.
- Sessions can be reviewed and revoked from account settings.
Channel & Data Access
Production data operations pass through fixed database functions and forced row-level security. Channel membership and role are rechecked for protected reads and writes.
Private channels, threads, search, files, and realtime events use the same access boundary. A client label, post, external result, or hidden field cannot grant authority.
Mutations use idempotency records, audit entries, and durable event ordering where the production path is active.
Files & Connected Services
Uploaded files are quarantined and scanned before they become downloadable. Scanning reduces risk but cannot guarantee that every harmful file will be detected.
External service credentials remain server-side. Connections receive only the bounded content required for a requested action, and their access is separate from a member's browser session.
Browser & Network Protection
Hosted Truffle uses HTTPS with HSTS. Content Security Policy, frame denial, MIME-sniffing protection, a restrictive referrer policy, and permission controls reduce browser attack surface.
Request quotas, body-size limits, exact origins, and authenticated callback boundaries are used at public and provider-facing endpoints.
Current Limits
No service can promise perfect security, and Truffle does not claim a security certification on this page.
Windows and macOS releases require verified signing, notarization where applicable, immutable checksums, and a release-bound update channel before publication. Isolated code execution is limited to reviewed repositories and must not be used with hostile code.
Report a Security Issue
Email hello@truffle.tech with the subject “Security report.” Include the affected URL or component, impact, reproduction steps, and a safe proof where possible.
Do not include other people's personal data, credentials, or destructive proof. Do not publicly disclose an unresolved issue before Truffle has had a reasonable opportunity to investigate and address it.