Security & Privacy Policy

Privacy & Data Protection

At Tirro, protecting your data and maintaining your trust is fundamental to how we operate. We are committed to transparency, security, and responsible data handling practices.

No Use of Data for Model Training

Customer data is never used to train, fine-tune, or improve any machine learning or AI models. Your data remains strictly isolated and is only used to provide the service you have explicitly requested.

No Collection of Personally Identifiable Information (PII)

Tirro is designed to operate without collecting personally identifiable information. We do not require or store names, email addresses, or other sensitive personal data unless explicitly required for account functionality—and even then, collection is minimized.

Secure Data Hosting

All data is hosted within secure, enterprise-grade infrastructure that follows industry best practices for availability, integrity, and confidentiality.

Encryption by Default

Data is encrypted both:

• In transit, using modern TLS protocols
• At rest, using strong encryption standards

This ensures your data is protected from unauthorized access at all times.

Strict Access Controls

Access to systems and data is tightly controlled using role-based permissions and authentication safeguards. Only authorized personnel can access systems where necessary, and all access is logged and monitored.

Data Minimization & Purpose Limitation

We only process the minimum amount of data required to deliver our services. Data is never used for purposes beyond what is explicitly agreed with our customers.

No Data Selling or Sharing

Tirro does not sell, rent, or share customer data with third parties for marketing or commercial purposes.

Data Retention & Deletion

Data is retained only for as long as necessary to provide the service. Customers may request deletion of their data at any time, and we ensure timely and secure removal.

Compliance & Best Practices

We align our practices with leading data protection standards and regulations, including GDPR principles, to ensure your data is handled responsibly.

Key Security Practices

• Role-based access control and least privilege principles
• Multi-factor authentication (MFA) for critical systems
• Encryption of data in transit and at rest
• Continuous monitoring and logging of systems
• Secure software development lifecycle (SDLC) practices
• Regular security reviews and risk assessments
• Incident response and breach notification procedures