Security

​

Data Residency

All customer data is stored and processed on cloud infrastructure hosted in London within GDPR compliance. Other data residency options are available. Contact support to discuss them.

​

Data Security

​

Encryption

​

Data Classification

Trophy processes the following categories of end-user data:

• User identifiers (anonymous external IDs provided by customers)
• Time zone identifiers (IANA)
• Gamification event data (actions, points, leaderboard ranks, timestamps, and similar events)
• Notification preferences (push notification and email subscription flags)

By default, Trophy does not store personally identifiable information (PII) directly. It is possible to send the following PII to Trophy, but it is not required:

• User name
• Email address

It is also possible to send custom attributes (customer-managed key-value pairs attached to users and events) to Trophy with PII-status determined by the customer use case. Trophy processes the following categories of customer data:

• Customer account and billing information

Trophy does not have access to customer passwords or credit card data.

​

Data Retention and Deletion

• Customer data is retained for the duration of the contract and deleted within 30 days of contract termination on written request.
• You can request deletion of your data at any time by contacting support@trophy.so.

​

Backups

• Daily automated snapshots of all databases
• Restore procedures are tested annually

​

Access Controls

​

Internal Access

​

Principle of Least Privilege

All internal access follows least-privilege principles. Engineers are granted access only to the systems required for their role. Production database access is restricted to senior engineers and requires justification.

​

Customer Data Isolation

Each customer’s data is isolated using customer-scoped API keys and row-level filtering. Customers can only access their own data.

​

Application Security

​

Development Practices

• All production code undergoes mandatory peer review before merge.
• Branch protection policies enforce this at the repository level, preventing direct commits.
• Dependency vulnerabilities are monitored continuously through GitHub security alerts.
• Secrets are never committed to source control.

​

Vulnerability Management

​

API Security

• All API access requires authenticated API keys scoped to the customer account.
• API keys can be rotated and revoked at any time in the Trophy dashboard.
• API keys are encrypted before they are stored in the database.
• Rate limiting is applied to all API endpoints to prevent abuse.
• Webhook signature verification is under customer control. Trophy recommends verifying signatures in webhook endpoints.

​

Web Application Security

• Access to the Trophy dashboard is secured by an identity provider that holds an independent SOC 2 Type II certification. The identity provider manages user authentication, including credential storage, session management, and token issuance. Trophy does not store or handle raw user passwords.
• Dashboard access follows the principle of least privilege. Admin accounts grant and revoke access for other members.
• Multi-factor authentication (MFA) for customer accounts is available on request.
• Single sign-on (SSO) for customer accounts is available on request.
• Sessions use short-lived JWT tokens with automatic expiry.
• Customer accounts are fully isolated at the data layer. Authenticated sessions are scoped to the issuing organisation and cannot access data belonging to other customers.
• Application development follows the OWASP Top 10 as a baseline for identifying and mitigating common web application vulnerabilities, including injection attacks, broken authentication, and security misconfiguration.

​

GDPR

• Trophy acts as a data processor for customer data under GDPR.
• Trophy is fully compliant with all GDPR practices and procedures for data handling.
• We are happy to enter into a Data Processing Agreement (DPA) with customers. Request one from your account contact.