Your data is yours. We just process it for you.

Who controls your data

When your firm uses YourKith, you are the data controller, it's your CRM and advisory data, and you decide what goes into the platform and why. Triarch acts as a processor, running the software and infrastructure on your behalf. We process the data to provide the service to you; we don't sell it, and we don't repurpose it for our own ends.

What data the platform processes

YourKith processes the operational data your firm puts into it and the signals you connect to it, including:

• • CRM and advisory records you create, companies, contacts, deals, engagements, contracts, finance and billing data.
• • Content from connected sources you choose to link, for example email, calendar, messaging, banking, and CRM integrations.
• • Contact details that may include personal data such as names, email addresses, and phone numbers.
• • Account and usage information needed to operate, secure, and audit your instance, including the audit log of access and actions.

You decide which sources to connect and what to load. The intelligence features of the platform derive insights from this data to help you run your operation.

We practice data minimization on connected sources, and it is worth being precise about what that does and does not mean. When content is ingested from a connected source, the raw body is held only until the platform has extracted what it needs from it, and is then erased. It is not kept indefinitely so that it can be re-read later. There is a hard ceiling on top of that: any raw body the platform never manages to analyse is erased anyway after 30 days, so nothing lingers merely because it was never looked at. Both windows are set per deployment and fail safe, an invalid setting shortens the window rather than lengthening it.

What we do not claim is that nothing personal is ever stored. Contact details you keep in the platform, names, email addresses, phone numbers, are stored because the product would not work otherwise; those are encrypted at rest, as described on our security page. And during the window between ingest and extraction, the raw source content genuinely is present in your database. It is encrypted in transit and at rest, and it lives in your own isolated instance, but we would rather tell you it exists than describe it as stripped.

Data isolation & retention

Each customer runs on a dedicated, single-tenant deployment, its own cloud project, its own database, and its own domain. Your data is never commingled with another customer's, and there is no shared multi-tenant database. For the technical detail of how this works, see our security page.

Retention follows your account. The records your firm creates, companies, contacts, deals, engagements, finance, persist for as long as your subscription is active. On account termination, your tenant and its dedicated environment are deleted, and backups may be retained for up to 30 days afterward before they are purged. Specific terms are set in the agreement between us.

Raw content pulled from connected sources is treated differently and more aggressively, as described above: erased once it has been analysed, and erased after 30 days regardless if it never was. One deliberate exception is worth naming. A calendar event's agenda is now kept until the platform has actually read it, rather than being erased the moment the meeting ends. That is a change we made on 8 August 2026, and it was a correction: the previous behaviour destroyed agendas before anything had a chance to use them, which lost you information you had every reason to expect the product to have. The same 30-day ceiling still applies.

Sub-processors

To deliver YourKith, we rely on a small set of infrastructure providers that may process data on our behalf:

A note on the AI keys, because the distinction matters and is easy to gloss over. When your firm supplies its own provider key, your firm chooses the provider and the calls run under your account, and we require an attested no-training / zero-data-retention configuration, which is enforced in code rather than merely promised. If you do not supply a key, the platform falls back to Triarch's managed provider keys so the features work without setup, and on that path the calls run under Triarch's provider account rather than yours. Either way your data stays inside your own isolated instance, but if you need the provider relationship to be yours, supply your own key.

Security measures

We protect your data with isolation by architecture, KMS-backed encryption of sensitive PII fields at rest, TLS in transit, hardened authentication with short-lived server-signed sessions in httpOnly cookies, role-based access control, and an audit log. The full description lives on our security page.

Data subject requests

If an individual whose personal data appears in your instance wishes to access, correct, or delete that data, those requests are generally directed to your firm as the data controller. As your processor, Triarch will support you in responding to such requests in line with our agreement and applicable law.

Contact

Questions about this statement, how we handle data, or any security matter? Reach us at mike@triarchsecurity.com.

This statement describes current practices and may be updated. Material changes will be reflected here with a revised effective date.