Privacy notice

Who is responsible

Triad Core is provided to businesses (our customers). For the records a customer keeps in its workspace (its customers, suppliers, documents, employees and so on) the customer decides what is processed and why, and Triad Global processes that information on the customer's behalf and on its instructions, as its service provider (processor). Questions about those records go first to the customer that invited you.

For the accounts people use to sign in, for security logs and for billing contacts, Triad Global, LLC is responsible (controller).

What we process

• Account details: name, work email, password (stored only as a salted hash), language and layout choices, and, when you use Sign in with Google, your Google account email and name. Google never creates a Triad Core account; it signs in an account your organization already invited.
• Workspace records your organization enters: contacts, documents, lines, notes, files and photos, stock, finance and, when the HR module is used, employee records such as working hours and leave. We do not ask for sensitive categories of data; a customer that stores them is responsible for its own legal basis.
• Security and usage data: sign-in times, IP address, browser type, one log line per request, and an audit trail of changes in each workspace.
• Triad AI questions and answers, when your organization has Triad AI switched on.

Why we process it

• To provide, secure and support the service the customer ordered (contract).
• To keep the service safe: rate limits, fraud and abuse prevention, audit trail, backups (legitimate interest and legal obligations).
• To send service emails such as invitations, password resets, approvals and alerts. We do not send marketing email from Triad Core.

Who helps us (sub-processors)

• Google Cloud (Google LLC): hosting, database, file storage, backups and logs, in the United States (us-east4, Northern Virginia).
• Google Vertex AI (Gemini models), only when Triad AI is on for a workspace. Requests are processed under Google Cloud terms, which do not allow Google to train its models on customer prompts or data.
• Google Identity, only when you choose Sign in with Google.
• An email delivery provider for service emails, when email sending is switched on.

We tell customers before adding a new sub-processor that handles workspace records. We do not sell or rent personal information and do not share it for advertising.

Where it is stored and international transfers

Triad Core data is stored in the United States. If you or your organization are outside the United States (for example in Korea, Israel or the European Union), your information is transferred to and processed in the United States. Customers that are subject to such rules (for example Korea's Personal Information Protection Act or Israel's Protection of Privacy Law) disclose this transfer to their own people and, where required, rely on the data processing terms in their agreement with Triad Global.

How long we keep it

Workspace records are kept for as long as the customer's agreement runs. Items moved to the recycle bin stay restorable until removed by the customer. After an agreement ends we delete or return workspace records within 30 days, unless the law requires us to keep them. Database backups roll off after 7 days. Security logs are kept for up to 30 days, the workspace audit trail for as long as the workspace exists.

Security

Encryption in transit (HTTPS with HSTS) and at rest; each customer's records separated at the database level (row-level security); role-based access with hidden fields for prices, costs and salaries; rate-limited sign-in; an append-only audit trail; daily backups with point-in-time recovery; secrets kept in a managed secret store. No system is perfectly secure; we will tell affected customers without undue delay, and within 72 hours of confirming a security incident that affects their records.

Cookies

Triad Core uses only cookies that are needed to run it: a session cookie that keeps you signed in, and small preference entries (language, theme, sidebar) kept in your browser. There are no advertising or analytics cookies in Triad Core.

Your choices and rights

You can see and change your name, language and password in your account menu. Depending on where you live you may have the right to access, correct, delete or receive a copy of your personal information, or to object to its use. For workspace records, ask the organization that invited you; we help it answer. For account data, or if you cannot reach your organization, email office@triadglobal.org with the subject "Privacy request". We answer within 30 days. You may also complain to your local data protection authority.

Children

Triad Core is a business tool and is not meant for children.

Changes

We update this notice when our practices change and show the date above. Material changes are announced to customer administrators in advance.