Security
HECVAT version: October 11, 2026
TRIOPilot is made by Tamahagane, LLC, a Wyoming limited liability company that operates from Florida. We are not SOC 2 certified, and no independent auditor or penetration tester has assessed us yet. Below is our completed HECVAT (Higher Education Community Vendor Assessment Toolkit), a self-assessment published by EDUCAUSE. Every Yes describes a control in place today. Every No says so plainly and states what we do instead. Student records, documents and backups are stored in the United States (AWS us-east-1, through Supabase). Each program's data is isolated by database row level security, and staff sign in with an emailed one-time code, so we store no passwords.
Our HECVAT
The same answers in two formats: the completed EDUCAUSE workbook, and a PDF you can read without Excel.
HECVAT is a product of EDUCAUSE. Questions © 2025 EDUCAUSE.
Subprocessors
These companies handle program data on our behalf. Each one is also listed in the HECVAT (question THRD-02).
Supabase
Managed PostgreSQL database, sign-in, and document storage, on AWS in us-east-1.
Data: All student and program data at rest.
Vercel
Application hosting and content delivery; Web Analytics and Speed Insights.
Data: All data in transit; for analytics, redacted page paths and page timings only, with no cookies and no identifiers.
Resend
Transactional email; and TRIOPilot product announcement emails to program staff, sent from a separate domain (updates.triopilot.com) with an unsubscribe link.
Data: Names and email addresses, sign-in codes, and staff notification emails that can name a student; for announcements, staff names and email addresses only, never student data.
Twilio
Two-way text messages and call forwarding, on a subaccount for each program.
Data: Phone numbers and message text.
Only when: the program turns texting on.
Google reCAPTCHA
Bot protection on the public application form.
Data: Interaction signals and IP address of the person filling in the form.
Google Translate
Translation of the application form.
Data: Application question and answer choice text written by the program, never student records.
Mapbox
Address autocomplete and report map tiles.
Data: Partial address text as it is typed; for map tiles, the viewer's IP address and the area shown.
Sentry
Error monitoring, hosted in the United States.
Data: The context needed to resolve an error, including student identity and request contents; credentials are always stripped.
Upstash
Rate limiting, with its primary region in AWS us-east-1.
Data: IP addresses, user ids, and sign-in email addresses, used as counter keys.
Stripe
Program subscription billing on hosted checkout.
Data: Billing contact and payment details of the paying program; no student data.
Anthropic
The in-app staff assistant, over the commercial API; and the operator's support tooling.
Data: Staff questions and the records the assistant looks up; support reports and error details, which can identify a student. Each program's assistant traffic can run under its own API credential and spend limit, which TRIOPilot can revoke for that program alone.
Only when: the program turns the assistant on (for the assistant).
GitHub
Source code and support records.
Data: Support report text, which can name a student, and the reporter's name and sign-in email.
Microsoft
Outlook calendar sync for advisors who connect a calendar.
Data: Appointment time and place, the student's first name and last initial, and the student's email as the attendee.
Only when: an advisor connects an Outlook calendar.
Questions
Email hello@triopilot.com. See also our Privacy Policy.