Keep the private work private.
OpenTrust separates public vendor evidence, workspace data, and a tightly bounded first-party usage ledger.
Account and workspace data
The service stores a confirmed email identity, hashed session and API tokens, credit activity, saved vendors, follow preferences, private profile-update and delivery history, opened records, source watches, and draft research requests. Profile alerts go to your confirmed account email only when you enable email updates. Connected agents can read your private feed using your workspace key. Unfollowing stops future profile alerts; removing a saved vendor also unfollows it, while existing update and research history stays in your workspace. OpenTrust does not store payment-card details.
Vendor profile requests
When you request a vendor, OpenTrust stores the company name and domain you deliberately submit with your account and notification preference. This request queue is private to you and authorized operators, separate from public search telemetry. We send one notification when a sourced public profile becomes available; you can cancel the notification from your vendor requests page. A temporary request draft stays in this browser tab for up to one hour. When you choose to sign in for a request, a one-hour browser copy lets an email confirmation return in another tab. Both copies are cleared after submission or sign-out.
Vendor list imports
CSV files and pasted spreadsheets are parsed in your browser. The original file, its filename, and unused columns are not uploaded or stored by OpenTrust. When you choose to review matches, only the mapped company names and domains are sent to the service. A request is saved only after you select missing vendors and confirm. Mapped list drafts use the same one-hour browser storage and sign-out cleanup as single requests. Already-published profiles link directly. You can explicitly save matched vendors to your private workspace. Importing or saving does not subscribe you to email or paid monitoring.
Usage and share telemetry
OpenTrust records allowlisted page and feature events, signup method and outcome, generated share codes, shared-link visits, coarse country, and pseudonymous visitor, visit, and daily network identifiers. A confirmed account may be linked after sign-in so the owner can understand adoption and leads.
What telemetry excludes
The application database does not persist raw IP addresses, passwords, authentication tokens, card data, keystrokes, arbitrary form values, raw search text, research-request text in telemetry, or unconfirmed signup email addresses. Network addresses are processed transiently for rate limiting and pseudonym generation; infrastructure request-log retention must be governed separately. Research-request text remains in the signed-in workspace record where it was intentionally submitted.
Retention
Daily network pseudonyms are cleared after 7 days. Client usage events expire after 30 days and authoritative conversion events after 90 days. Cleanup runs at service startup and hourly while it is active. Share-attribution tokens are accepted for one year; the public destination continues to work after attribution expires. Confirmed lead attribution remains with the account and is removed with it.
Managed services
Supabase Auth handles account credentials and sign-in providers. InsForge hosts durable application state, the first-party usage ledger, and verified payment events. Stripe hosts checkout and processes card details. OpenTrust does not load a third-party session-replay or advertising tracker.
What stays public
Vendor names, domains, source discovery metadata, and a limited record preview. Restricted research is excluded from unauthenticated responses, not merely blurred in the browser.
Current boundaries
Research requests remain drafts and are not dispatched automatically. Customer-authorized documents, live reviewer assignment, and a self-service deletion workflow are not represented as connected until they are separately implemented and verified.