1. Overview
At TrueGrow AI Inc. ("TrueGrow AI," "MediaFlow," "we," "our," or "us"), protecting the confidentiality, integrity, and availability of user data is a top priority.
This Security Statement outlines the administrative, technical, and organizational safeguards we use to protect data processed through the MediaFlow platform, including influencer, agency, and company portals.
This Statement supplements our Privacy Policy, Terms of Service, and Data Processing Addendum (DPA).
2. Security Governance
TrueGrow AI maintains a formal security program designed to:
- Protect user data against unauthorized access, disclosure, alteration, or destruction
- Ensure compliance with applicable privacy and security laws
- Meet the security expectations of third-party platforms (Meta, TikTok, Google, YouTube, LinkedIn)
- Support secure AI-powered workflows
Security responsibilities are shared across engineering, operations, and leadership teams.
3. Infrastructure & Hosting
MediaFlow is hosted on secure, enterprise-grade cloud infrastructure, including:
- Google Cloud Platform (GCP)
- Supabase (database and authentication layer)
Key protections include:
- Isolated environments
- Network-level firewalls
- Secure VPC configurations
- Automated monitoring and logging
4. Encryption
Data in Transit
- All data transmitted between clients, APIs, and servers is encrypted using TLS 1.2 or higher.
Data at Rest
- Stored data is encrypted using AES-256 or equivalent industry-standard encryption.
- Sensitive credentials (including third-party platform access tokens and refresh tokens) are encrypted using AES-256-GCM encryption with secure key management.
5. Access Controls
User Access
- Role-based access control (RBAC) governs user permissions
- Users can only access data associated with their authorized account and role
Internal Access
- Access to production systems is restricted to authorized personnel only
- Multi-factor authentication (MFA) is required
- Least-privilege principles are enforced
- All internal access is logged and audited
Authorized personnel may include:
- Engineers
- Developers
- System administrators
- Customer support / technical support staff (only when necessary and, where applicable, with customer approval)
6. Data Retention & Lifecycle Security
Retention Principles
TrueGrow AI follows strict, documented retention rules that align across all legal documents.
Retention Summary
| Data Type | Retention |
|---|
| Direct Messages | 21 / 45 / 90 days (user-selected; default 45) |
| Comments | 7 / 14 / 30 days (user-selected; default 14) |
| Analytics & Performance Data | Retained while account is active (subscription-tier based) |
| Platform-Generated Data (reports, dashboards, AI outputs) | Retained while account is active (subscription-tier based) |
| Access Tokens | Deleted immediately upon revocation |
| Backups | Purged within 30 days |
Revocation & Deletion
- API tokens are revoked immediately upon disconnection
- Associated data is securely deleted within 30 days
- Deletion processes apply to both primary systems and backups
7. AI Processing Security
TrueGrow AI integrates AI services from OpenAI, Google Gemini, and Anthropic to support optional AI-powered features.
Security measures include:
- AI processing occurs only when explicitly enabled by the user
- Only minimal required data is transmitted to AI providers
- Data is transmitted over encrypted channels
- AI outputs are returned directly to the platform
- We do not intentionally permit AI providers to train public or external models using identifiable user data
AI-generated content may be subject to user review or automated approval, depending on user settings.
8. Monitoring & Logging
We maintain continuous monitoring and logging systems to detect and respond to:
- Unauthorized access attempts
- Suspicious behavior
- Performance degradation
- API misuse
- Security incidents
Logs are retained in accordance with operational and compliance requirements.
9. Vulnerability Management
Security practices include:
- Regular dependency updates
- Vulnerability scanning
- Patch management
- Secure coding standards
- Code reviews for security-sensitive changes
10. Incident Response
TrueGrow AI maintains an incident response process designed to:
- Identify and contain security incidents quickly
- Mitigate impact
- Investigate root causes
- Restore affected systems
- Notify customers and regulators when required
In the event of a Personal Data breach, customers will be notified without undue delay, in accordance with applicable law and the DPA.
11. Business Continuity & Backups
- Encrypted backups are performed regularly
- Backups are stored securely and access-restricted
- Backups are purged within 30 days of account deletion or data-deletion requests
Disaster recovery plans are designed to minimize downtime and data loss.
12. Third-Party Risk Management
All third-party service providers and subprocessors are subject to:
- Security due diligence
- Contractual confidentiality and data-protection obligations
- Ongoing review
Key subprocessors include cloud hosting providers, AI providers, analytics services, and payment processors.
13. Compliance
TrueGrow AI aligns its security practices with:
- GDPR / UK-GDPR
- CCPA / CPRA
- Industry best practices for SaaS platforms
- Platform security requirements (Meta, TikTok, Google, YouTube)
14. User Responsibilities
Users are responsible for:
- Securing their login credentials
- Enabling available security features
- Ensuring authorized use of connected accounts
- Managing user permissions within their organization
15. Updates to This Statement
We may update this Security Statement periodically to reflect changes in technology, legal requirements, or platform features.
Material changes will be communicated via email or in-app notification.