Security, privacy, and governance information for customers and their assessors — published so that due diligence on TPTH can be completed without a questionnaire cycle.
TPTH is a professional services firm — third-party risk advisory, managed risk services, training and certification, AI governance, and supply chain threat hunting. It does not host a software product, and no customer production system depends on its availability. That shapes most of what follows, so it is worth reading before the rest.
Goal: a fast, credible understanding of TPTH's security and compliance posture.
Third Party Threat Hunting LLC operates a documented information security program aligned to the NIST Cybersecurity Framework 2.0, scoped as described in NIST SP 1300 for small businesses. The program is governed by a single policy manual, two operational plans, and a subcategory-level control profile, all reviewed annually and on any triggering event.
TPTH takes an unusual position for a trust center, and states it here rather than burying it: where a control is not in place, this page says so. Section 10 publishes every open gap with a target date. A vendor who publishes only its strengths is asking you to assess it on incomplete information — which is precisely what TPTH advises its own clients not to accept.
In scope: all client data held by TPTH; the Company's Microsoft 365 tenant and the Company Google account; all endpoints used for Company work; the Company website and training delivery; and all services listed in §5. Covers Advisory Services, Managed Risk Services, Training and Certification, AI Training and governance advisory, and Threat Hunting / vendor monitoring.
Out of scope: customer-owned systems and environments. Where TPTH personnel work inside a customer environment on customer-issued credentials and equipment, the customer's policies govern and TPTH personnel comply with the stricter of the two standards.
| Area | TPTH is responsible for | You are responsible for |
|---|---|---|
| Your data in TPTH custody | Classification, encryption, access restriction, retention and destruction | Providing only the data the engagement needs; labeling sensitivity |
| Work in your environment | Personnel vetting; adherence to your policy; use of your issued credentials | Provisioning, monitoring and deprovisioning access; environment controls |
| Assessment findings | Accuracy of analysis; secure delivery; retention limits | Remediation decisions and risk acceptance |
| Sub-processors | Selection, due diligence, disclosure and monitoring | Reviewing the §5 list and objecting where your contract provides for it |
TPTH classifies information in four tiers — Restricted, Confidential, Internal, Public. Client vendor assessment findings and material received under NDA are Restricted; training participant records are Confidential. Restricted data is held in Company-managed tenants. Local and cached copies — including mailbox content on mobile devices — exist only on Company-managed, MDM-enrolled endpoints with full-device encryption, enforced passcode and remote wipe. Restricted data is never sent as an email attachment, is never placed on removable media, personal or unmanaged devices, or consumer file-sharing accounts, and is encrypted at rest and in transit.
Data TPTH does not accept. Engagements are structured so that TPTH does not require, and will not knowingly accept: Protected Health Information; cardholder data or payment credentials; government classified or controlled unclassified information; production credentials, API keys or live access tokens; or customer end-customer personal data beyond what the engagement strictly requires. Declining a category of data is treated as the strongest available control over it.
Retention. Restricted engagement data is held for the duration of the engagement plus 90 days. Deliverables are held for 12 months unless the contract says otherwise. Training records are held for five years from the latest certificate, attestation or renewal date, then deleted. Certified destruction is provided on request.
Goal: reach the right function without chasing an inbox.
| Purpose | Contact | Use this for |
|---|---|---|
| Security | security@thirdpartythreathunting.com | Security questionnaires, control evidence requests, architecture questions |
| Privacy / data protection | privacy@thirdpartythreathunting.com | DPAs, data subject requests, international transfer questions |
| Compliance & due diligence | trust@thirdpartythreathunting.com | Gated artifact access, due diligence packet, NDA execution |
| Vulnerability disclosure | security@thirdpartythreathunting.com | Reporting a vulnerability in a TPTH public property — acknowledged within 2 business days |
| Incident reporting (customer-facing) | security@thirdpartythreathunting.com | Reporting a suspected incident involving TPTH or your data |
| Escalation | Chief Executive Officer | Unresolved matters, contractual escalation, incident escalation. The CEO is the incident commander. |
Who is behind these addresses. TPTH is a principal-led firm that has engaged its first Associate under a written agreement (executed Oct 15, 2026). The addresses above are role aliases routing to the Chief Executive Officer, who monitors them each business day — there is no support queue behind them and no Associate monitors them, and TPTH would rather say so than imply a team that does not exist. The acknowledgment commitments published in §9 are met by the Chief Executive Officer directly.
Responsible disclosure. TPTH does not develop or distribute software, so there is no product vulnerability program. Vulnerabilities found in TPTH public properties may be reported to the address above and will be acknowledged within two business days. Please do not conduct testing that degrades availability or accesses data that is not yours.
Goal: governance and control intent documentation.
All policies live in one controlled document — TPTH-ISMS-001, Information Security Policy Manual, v1.3, effective 2026-09-13, approved by the Chief Executive Officer, next review 2027-09-11. Individual policy summaries are public; the full manual is available under NDA. Each card below names the governing section.
Program scope, governing principles, legal and contractual obligations, and the accountability model — including an explicit disclosure that duties are not segregated at this firm size, and how that is compensated.
Risk register content, 5×5 rating, mandatory treatment above High, and the trigger events that force a review — incident, new sub-processor, service change, contract requirement, threat change.
Inventory of endpoints, cloud services, domains and physical records. Assets are entered before use; shadow IT is prohibited; quarterly reconciliation catches undisclosed services.
Four-tier scheme with per-tier handling rules, the list of data categories TPTH refuses to accept, retention periods by record type, and secure disposal including certificates of destruction.
MFA enforced everywhere with no exceptions (on Associate Microsoft 365 mailboxes it is switched on per user and confirmed at first sign-in, because the reseller tenant cannot enforce it tenant-wide; see §10 item 6); least privilege by engagement; semi-annual access reviews; one-business-day revocation. Credentials in Apple Passwords, with the absence of an administrative console stated as a limitation rather than glossed.
Minimum cryptographic standards at rest, in transit, on endpoints and on the website, plus key management position — including that TPTH does not operate customer-managed keys and does not claim to.
The baseline every device meets before first use: encryption, EDR, host firewall, auto-update, screen lock, inventory entry. Personal and unmanaged devices are excluded from client data.
72 hours for critical or actively exploited, 14 days high, 30 days medium. Monthly verification rather than assuming automatic updates succeeded. CISA KEV monitored.
Covers changes to systems holding client data. States plainly that a Secure SDLC policy is not applicable — TPTH does not develop, host or distribute software — rather than claiming one.
Clear desk and screen, device custody in transit, travel and public-space working rules, periodic tamper inspection, and compliance with customer site rules without exception.
Includes an absolute prohibition on secondary use: knowledge of a vendor's weaknesses obtained in one engagement is never used, referenced or hinted at in another.
Written agreement, NDA, manual acknowledgment and screening before any access. 24-hour incident notification flowed down. Offboarding within one business day with destruction confirmed in writing.
Onboarding and annual training covering phishing, BEC, credential hygiene, classification-based handling, incident reporting and AI tool use. Completion recorded and retained.
Platform audit logging and alerting across both tenants, EDR alerting, monthly review. Explicitly states that TPTH operates no SIEM and no 24×7 SOC, so that limitation is not inferred away.
Four-level severity matrix, CEO as incident commander, and the notification commitments in §7. Full operational plan (TPTH-IRP-001) includes scenario playbooks and a first-hour checklist.
RTO 4 hours for client communication, 24 hours for engagement data; RPO 24 hours. Discloses that these are objectives not yet demonstrated by a restoration test, and that no independent backup is in place. See §10 item 1.
Due diligence before any third party touches client data, annual review of material sub-processors, quarterly reconciliation, public disclosure, and 30 days' notice before a new sub-processor begins processing.
Tool approval gated on contractual exclusion of submitted data from model training; classification-based restrictions; customer instructions against AI processing treated as absolute; a human accountable for every deliverable.
Processor / controller roles by context, GDPR Article 28 and Article 30 commitments, transfer mechanism, data subject request handling within five business days, and training participant data use.
Exceptions are written, time-bounded to a maximum of twelve months, recorded in the risk register, and disclosed to an affected customer on request. Monthly expiration sweep keeps published artifacts current.
Subcategory-level mapping across all six functions: status, governing policy section, how the control is implemented, and what evidence exists. 76 subcategories profiled.
Every open control gap with its CSF reference, risk if unaddressed, remediation plan, owner and target date. Published in full at §10 of this page.
Goal: evidence of control operation and independent validation.
Independent assurance: none held. TPTH does not hold a SOC 1, SOC 2, ISO/IEC 27001 or equivalent report, and does not claim one. An independent assessment will be evaluated once the items at §10 are closed. Any statement you encounter elsewhere suggesting TPTH is SOC 2 or ISO certified is incorrect and should be reported to the contacts in §2.
What is available instead is self-assessed but documented, dated and evidenced — set out below so you can weight it appropriately in your own assessment.
| Artifact | Coverage period | Nature | Access |
|---|---|---|---|
| NIST CSF 2.0 Control Profile (TPTH-CSF-001) | 2026-09-11 → 2027-09-11 | Self-assessed, subcategory level, with evidence references | NDA |
| Internal risk assessment output | Current register | Self-assessed, with treatment decisions and owners | NDA |
| Control Gap Register | Current | Self-assessed, published in full at §10 | Public |
| Access review records | Planned from 2026-11-06 | Control evidence, dated. The first record will be a VAULTS™ access review of the first Associate’s access, planned by Nov 6, 2026 and not yet performed. The first semi-annual cycle is not yet due (2027-03-11). | NDA |
| Incident response exercise report | From Q1 2027 | Tabletop findings — not yet performed | NDA |
| Backup restoration test record | From Q4 2026 | Not yet performed — see §10 item 1 | NDA |
| Penetration test | — | Not applicable. TPTH operates no product or customer-facing application to test. | — |
Assess TPTH as a professional services provider with access to sensitive data, not as a hosted software vendor. The risk it presents is confidentiality of the data you share with it, not availability of a system you depend on. The controls that matter most in that model are §3 (access control), §6 (data handling and retention), §14 (personnel and subcontractors) and §19 (sub-processors) of the manual — and those are the areas where the profile shows controls operating.
Remediation approach. Findings — whether self-identified, raised by a customer assessment, or arising from an incident — are entered in the risk register with an owner and a target date, prioritized by residual rating, and tracked to closure at the annual program review. Findings raised by a customer are reported back to that customer on closure.
Goal: transparency into supply chain risk.
Material sub-processors that may store, process, transmit or access customer data in the course of TPTH delivering its services. Effective 2026-09-11 · last updated 2026-09-25.
| Provider | Service performed | Data categories | Processing locations | Material |
|---|---|---|---|---|
| Google — Gmail and Drive Google LLC | Email, document storage and collaboration — system of record for engagement material | Restricted and Confidential customer data; training records | US / EU | Yes |
| Microsoft 365 Microsoft Corporation | Email, document storage and collaboration — second tenant | Restricted and Confidential customer data | US / EU | Yes |
| Zoom Zoom Communications, Inc. | Client sessions, assessment interviews and training delivery, including the in-platform AI meeting assistant used under the controls below | Confidential; Restricted where discussed in session, including anything captured by the assistant | US | Yes |
| Square Block, Inc. | Course and engagement billing; session booking | Participant contact and billing records. No card data is received or stored by TPTH. Card data is processed by Square as an independent controller under its own PCI DSS scope, which is why this row is not material. | US | No |
| Resend Plus Five Five, Inc. | All outbound mail from the website: contact form submissions, requested resource downloads, Fourth Party newsletter confirmations and issues, and the internal notification raised when a CATRP ethics attestation is passed | Name, work email and organization supplied to a website form, and the message body where one is written. Subscriber email addresses, one recipient per send, for each newsletter issue. Candidate name, email and score in the attestation notification, which is a Confidential training record under §1. No Restricted client engagement data. The provider retains message data for 30 days. | US | Yes |
| Riverside Riverside.fm Ltd. | Recording and production of the Third Party Threat Hunters podcast | Public and Internal content only. No customer engagement material. | US / EU | No |
| Buzzsprout Higher Pixels, Inc. | Hosting and distribution of the public Third Party Threat Hunters podcast | Public content only. No customer data. The provider processes listener IP addresses for download statistics. | US | No |
| Cloudflare Cloudflare, Inc. | Authoritative DNS, CDN and WAF, website hosting on Workers, cookieless web analytics, and the Turnstile human check on public forms. Hosts this Trust Center. Also hosts the two Cloudflare D1 databases behind the site: the Fourth Party subscriber list and the training record (CATRP ethics attestation and course exam passes). Also hosts the private videos for the free BEACON class and the free VAULTS training on Cloudflare Stream. | Public website content; page views and referrers in aggregate, with no cookies, no query strings and no individual identified. Turnstile human check: visitor IP address and browser signals, processed in transit; no form content. Also personal data at rest in D1: newsletter subscriber email addresses with signup, confirmation and status and, on the same record, the dates an address first and last opened the free BEACON class or the free VAULTS training and how many times; and attestation and course exam pass records — candidate name, email, exam, score, date and attestation signature — which are Confidential training records under §1. Exam attempt counters are held in Workers KV for 24 hours under one-way hashes, with nothing readable. No Restricted client engagement data. | US | Yes |
| GoDaddy GoDaddy Inc. | Domain registration only. Website hosting and authoritative DNS moved to Cloudflare on Sep 19, 2026; the registrar transfer is scheduled and this row closes when it completes. | Public content only. No customer data. | US | No |
| BoldSign Syncfusion, Inc. | Electronic signature for mutual NDAs — including those executed for access to gated material listed at §3 — and for associate and subcontractor agreements. The provider’s AI form-field detection reads uploaded documents; see the note below the table. | The content of executed NDAs and contracts, which is Confidential. Signatory name, email address, IP address and device, recorded in the audit trail. No client engagement data and no assessment findings. | US | Yes |
| SimpleMDM PDQ.com Corporation | Mobile device management for the Company endpoints — configuration, encryption and passcode enforcement, and remote wipe | Device inventory and configuration metadata only. No customer data. Treated as material because it holds the disk recovery key for, and can execute scripts on, the endpoint that handles Restricted data. | US | Yes |
| Apple Apple Inc. | iCloud Keychain as the Company credential store, and device backup for the Company mobile endpoint | Company credentials and device backup content. Advanced Data Protection is enabled, so backup content is end-to-end encrypted and Apple holds no key to it. | US | No |
One capability above warrants separate explanation, because TPTH would want it explained if the roles were reversed. The video conferencing platform includes an AI meeting assistant. Unlike every other service listed, an assistant does not receive data TPTH chose to send it — it receives whatever is said in a session it attends. Where that session is a vendor assessment interview, customer information can reach an AI service without a deliberate act of transmission. TPTH used a standalone assistant until September 2026 and withdrew it, because its terms did not exclude submitted content from model training; the provider has confirmed in writing that the data it held was deleted. The assistant now in use is built into a platform already assessed and listed above, so no AI service is added to this list for the purpose.
TPTH therefore applies controls additional to its general sub-processor requirements, at Manual §19.7:
The questions that decided both assistants — whether submitted content trains the provider’s model, and what the contract actually says about it — are the Access & Data and Contractual Accountability categories of BEACON™, the framework TPTH uses to assess AI in its clients’ vendors. The withdrawal recorded at version 1.2 is that framework applied to TPTH’s own supply chain.
Recorded here at the same standard TPTH applies to any vendor, which means recording what is published and what is not. BoldSign publishes a SOC 2 Type 2 page stating an annual audit over a twelve-month window by an independent CPA organization. It does not publish the auditor’s name, the audit period dates or the report date, and there is no trust portal: the report is obtainable only through a request form reviewed by the provider’s legal team. TPTH has not yet obtained or read the report, so the SOC 2 is recorded as claimed and documented but unverified, and this line will be updated when it has been read. The page claims all five trust services criteria, which is unusually broad and is one of the things to check against the report itself. No ISO/IEC 27001 is claimed. Penetration testing is described as performed by in-house staff rather than an independent third party. An Article 28 data processing agreement is published and self-serve, incorporating the EU Standard Contractual Clauses, and a sub-processor list is published with per-vendor processing regions. Breach notification is “without undue delay” with no numeric commitment. Two things are stated because an assessor would find them: the provider’s parent operates a development affiliate in India whose personnel access to production is not addressed in any published document, and TPTH’s account is currently on a free plan opened under a personal address, which is being moved to the Company tenant. Until it is, the audit trail on an executed agreement records a personal rather than a Company address.
The provider’s AI form-field detection reads the content of uploaded documents, which for TPTH means NDAs and contracts. The provider publishes that requests run with zero-data-retention enabled, that prompts and responses are not stored by the AI provider, and that customer data is not used to train models; the AI sub-processors named are Azure OpenAI and Google Cloud Vertex AI. That position is recorded as published rather than as verified, and the feature is assessed under BEACON™ like any other vendor AI capability.
Reviewed on Sep 24, 2026 against the documents themselves rather than the provider’s summary of them. Resend is the trading name of Plus Five Five, Inc., the entity named in its audit report and data processing addendum. SOC 2 Type 2 — held and read. Issued by Advantage Partners (Seattle, WA) on May 5, 2026, covering Feb 1, 2025 to Feb 1, 2026, with an unqualified opinion. Its scope is the Security criteria only; availability, confidentiality, processing integrity and privacy were not examined. One exception was reported: S3 server access logging and VPC Flow Logs were not enabled during the period. Management states both have since been enabled; that remediation is taken on its word until the next report tests it. The report carves out AWS and Vercel as subservice organizations, but the provider’s own system description also lists Railway, Supabase, Inngest, Redis, ElasticSearch, Snowflake, Tinybird and RunPod — the report gives no assurance over those, which rest on the provider’s contracts and sub-processor list alone.
Penetration testing is independent: Oneleet tested the dashboard and API between 11 and Nov 25, 2025 and attests to no critical or high findings and none unresolved. Only the attestation letter was reviewed, not the report, and the email-sending infrastructure was outside its scope. The data processing addendum is pre-signed by the provider (Jan 14, 2026) and incorporates the EU Standard Contractual Clauses and the UK Addendum. It gives fourteen days’ notice of new sub-processors with a right to object, commits to breach notification “without undue delay” with no numeric period, and deletes customer data within ninety days of account closure — separate from the thirty-day message retention stated above. It states certification under the EU–U.S. Data Privacy Framework; TPTH has not yet checked the public listing, so that is recorded as stated rather than verified.
AI in the fourth-party path. Resend’s published sub-processor list names Anthropic PBC and RunPod, Inc., and RunPod also appears in the infrastructure its audit report does not cover. They are the vendor’s sub-processors, not TPTH’s, and the data in that path is limited to what is described in the Resend row. They are named here, permanently rather than only in the change log, because TPTH asks the vendors it assesses to name the AI in their supply chain.
Goal: state what standards and regulations TPTH aligns to — precisely.
On language. TPTH uses aligned where it has mapped its controls to a framework and self-assessed against it; certified and attested only where an independent third party has issued a report. TPTH currently holds no certifications or attestations. Everything below is alignment.
| Framework / regulation | Position | Evidence |
|---|---|---|
| NIST CSF 2.0 (NIST SP 1300 small business scoping) | Aligned — 76 subcategories profiled at subcategory level | TPTH-CSF-001 Control Profile · gated |
| GDPR (EU 2016/679) | Compliance obligations identified and addressed. DPA with Article 28 terms available; Article 30 record maintained; 72-hour authority notification. | DPA on request · Manual §21 |
| US state breach notification | Obligations assessed by residence of affected individuals; notification within statutory timeframes. | Manual §17.2 · TPTH-IRP-001 §5 |
| NIST AI RMF / ISO/IEC 42001 | AI governance practice aligned in approach. Not certified; no claim of conformity. | Manual §20 |
| HIPAA | Not applicable by design. TPTH does not require or accept PHI. Will not execute a BAA without a specific written arrangement and control assessment first. | Manual §6.4 |
| PCI DSS | Out of scope. Payments are processed by a third-party processor; TPTH does not receive or store cardholder data. | Manual §6.4 |
| SOC 2 / ISO 27001 | Not held — to be evaluated once §10 items 1–4 close. | §10 item 5 |
Goal: operational transparency and customer confidence.
There is no status page, because there is no hosted service. TPTH provides professional services; it does not operate a multi-tenant application, and no customer production system depends on TPTH uptime. A TPTH disruption delays advisory work and training — it does not take one of your systems down. Customers performing a business impact analysis should classify TPTH as a non-critical, substitutable service provider.
Where you depend on a TPTH-delivered milestone, the continuity commitments below apply.
Stated honestly: these are objectives, not demonstrated capability. They will be validated against a measured result once the restoration test at §10 item 1 is complete, and this section will be updated to say which.
Planned maintenance is not applicable — TPTH operates no customer-facing system requiring maintenance windows. Changes to this Trust Center are recorded in the change log at §12.
Goal: proof of coverage and other formal certificates.
Coverage is bound with Hiscox, effective Sep 18, 2026 for a twelve-month term.
| Coverage | Per occurrence | Aggregate | Notable inclusions |
|---|---|---|---|
| Cyber liability | $1,000,000 | $1,000,000 | Digital media liability at the full limit. Cyber crime, system failure, reputational harm and enhanced privacy regulation are sublimited — see below. Includes a breach response panel supplying forensic investigators and counsel. |
| Professional liability (E&O) | $1,000,000 | $1,000,000 | Blanket additional insured |
| General liability | $1,000,000 | $2,000,000 | Blanket additional insured; electronic data liability |
The $1,000,000 cyber limit is a ceiling, not the amount available for every kind of loss. TPTH publishes the sublimits because a limit quoted without them overstates the cover. Every sublimit below is shared — part of the $1,000,000, not in addition to it.
| Cyber coverage | Sublimit |
|---|---|
| Ransomware event | $25,000 |
| Business interruption (own breach) | $100,000 |
| Cyber crime — funds transfer fraud, social engineering | $50,000 |
| System failure | $50,000 |
| Bricking | $50,000 |
| Enhanced privacy regulation | $100,000 |
| Reputational harm | $250,000 |
| Utility fraud | $250,000 |
| Dependent business interruption | Not covered |
| Dependent system failure | Not covered |
Two exclusions an assessor should know about. Dependent business interruption and dependent system failure are not covered, so an outage at one of the sub-processors listed at §5 that halts TPTH delivery is a loss the Company carries itself rather than one transferred to an insurer. And the retroactive date is Sep 18, 2026, the inception date, so there is no prior acts cover — anything that first occurred before that date sits outside the policy whenever it is discovered. Retention is $10,000 on cyber.
Goal: reduce repeat effort and accelerate your due diligence.
If this page has not answered your question, request the packet rather than sending a questionnaire — it is faster for both of us, and it is the same content every customer receives.
TPTH has not yet published a completed standard questionnaire — this Trust Center and the control profile are the first release, dated 2026-09-11. If your organization requires a specific template (CAIQ, SIG, or your own), send it and it will be completed from this same source content, then retained and reused so that every requester receives the same answers. Once published, responses are refreshed at each quarterly review — the first is due 2026-12-11 — and immediately on any material change.
Goal: tell you what is not in place, before you have to ask.
Every control gap, with its target date — closed items stay on the list rather than disappearing, so you can see what was committed and what was delivered. These are also disclosed in Appendix B of the policy manual and tracked in the risk register. Item 1 is now the one most assessors will raise first.
In progress. The first encrypted 2 TB drive was installed and Time Machine configured on Sep 13, 2026. Recovery still relies on native Google account and Microsoft 365 retention plus mirrored local copies, and has never been restored from. Approach: encrypted local backup with two drives in rotation, one always disconnected and offsite, chosen over a managed service that would become a material sub-processor holding a copy of customer data. Outstanding: second drive into offsite rotation; retention depth to accrue, first testable Nov 12, 2026; and a documented restoration test. Impact reassessed and reduced on Sep 13, 2026 — engagement data is short-lived by policy and customers ordinarily hold their own copy, and the record of which individual holds which certification is now maintained in a dedicated register rather than as image files alone. The item stays open regardless: a lower internal impact is not a reason to withdraw a commitment, and restoration is still untested. CSF PR.DS-11, RC.RP-03
Closed — bound Sep 11, 2026, in force Sep 18, 2026. Cyber liability, professional liability and general liability bound with Hiscox at $1M limits — see §8. The cyber policy also supplies a breach response panel, which closes the related weakness of having no forensic provider or breach counsel on call. Retained here rather than deleted, so the register shows what was committed and what was delivered. CSF GV.RM-04
Company credentials are held in Apple Passwords with end-to-end encryption, which protects them well — and means no second party can reach them. During an extended absence of the principal, customer data and obligations could be stranded. Remediation is under way. An Apple Account Recovery Contact was designated on Sep 13, 2026, which addresses lockout of a present owner but not incapacity — a recovery contact supplies a code to the account holder rather than acting in their place. Due diligence established that no provider mechanism solves this: a Legacy Contact expressly excludes the credential store, so neither recovery route returns credentials to a second party. Outstanding, therefore: a sealed credential record held with the Company’s legal representation under a documented release condition covering incapacity as well as death, and escrow of the disk recovery key, which is a separate secret from the account. CSF PR.AA-01, RC.RP-01
The plan is written and the severity matrix and playbooks are defined, but no tabletop has been run — so the response assumptions are untested, which matters most for a single-responder firm meeting a 24-hour notification clock. Remediation: documented tabletop against the business email compromise scenario, findings recorded and the plan amended. CSF ID.IM-02
No SOC 2 or ISO/IEC 27001, so customers rely on self-attestation and due diligence cycles run longer in regulated sectors. Remediation: evaluate readiness for an independent assessment or SOC 2 Type I once items 1 to 4 are closed. Program level
The same individual operates and approves every control. This is a structural consequence of firm size, not a remediable gap, and TPTH discloses it rather than claiming a separation it does not have. Compensated by: dated evidence retention so a third party can reconstruct what was done and when; an annual program review performed against the manual as a checklist; and customer access to evidence for any control. Reassessed if headcount changes.
Update, Oct 21, 2026. TPTH engaged its first Associate under a written agreement (executed Oct 15, 2026). The limitation stands: an Associate delivers work under TPTH’s controls and does not operate or approve them, so the same individual still does both. Associates are bound by the Associate agreement and acknowledge the Information Security Policy Manual in writing. The onboarding sequence is set so that access follows three steps: the manual is acknowledged, the device used for TPTH work is enrolled in device management, and MFA is confirmed at first sign-in. As of this version the first Associate’s mailbox and device enrollment are not complete, and he does not sign in to TPTH systems until they are.
Known gaps in Associate email. Associate mailboxes run on Microsoft 365 bought through GoDaddy. That reseller tenant keeps three controls out of reach: tenant-wide MFA enforcement, a block on user consent to third-party applications, and Conditional Access. MFA is therefore switched on per user and confirmed at first sign-in rather than enforced by the tenant. Email stays on GoDaddy until at least the January 2027 review.
Review of Associate access. The first Associate’s access will be reviewed with TPTH’s own VAULTS™ method and the findings recorded, including any settings the tenant keeps out of reach. That review is planned for Nov 6, 2026 and has not been performed; it will be cited here when it is done. CSF GV.RR-02
The least that makes a certificate verifiable, and nothing beyond it. TPTH issues certificates and a credential, and both are worthless if a holder or a future employer cannot confirm them later. Everything retained about a student exists to serve that single purpose.
What is held: the name as it appears on the certificate, an email address, the course or attestation taken, the score where one applies, and the date. For an issued credential, the credential ID.
For an exam, it also holds the student’s typed-name signature on the identity attestation that stands in for a proctor.
What is not held: the answers a student gave, which questions they got wrong, how long they took, or anything about their device, browser or location. A failed attempt at the ethics attestation or a course exam is not recorded — no history of attempts is kept. The one exception is short-lived: to limit each exam to three attempts in 24 hours, the site keeps a counter under a one-way hash of the exam, the network address and the email entered, which holds nothing readable, is not linked to any result, and deletes itself 24 hours after the first attempt it counts. A record of someone’s failures serves no purpose TPTH has, so it is not created.
How long: five years from the date of the latest attestation, certificate or renewal, then deleted. Long enough that a credential remains confirmable across a normal hiring cycle and any continuing-education audit, short enough that it does not become an indefinite file.
How it is confirmed: the public register at /verify holds no names and no addresses — only one-way hashes of a credential ID paired with a surname. The check runs in the visitor’s browser, so TPTH does not learn who verified a credential, or when. The underlying record described above is held privately and is never published.
This is not marketed as a privacy feature; it is what purpose limitation means applied to a training business. TPTH asks its own vendors what they collect and why, and this page answers that question about TPTH.
Send the newsletter, and nothing else. Fourth Party is a weekly letter. Subscribing stores one thing about you: the address itself, with the dates you signed up and confirmed, and which form you used.
Confirmed opt-in. A signup sends one confirmation mail and nothing further. Until you click the link in it you are not subscribed and will receive no issues. This is stricter than US law requires, and it means a mistyped or malicious signup cannot be used to mail a third party repeatedly.
No tracking. There is no open tracking, no click tracking and no tracking pixel. Nothing records whether you read an issue or which links you followed, and no IP address or device signal is stored at signup or at confirmation. A firm that sells third-party risk assessment should not keep a behavioral profile of its readers without a reason it can state, and there is not one.
Unsubscribing. Every issue carries a one-click unsubscribe that works on the first click, implemented with the List-Unsubscribe and List-Unsubscribe-Post headers (RFC 8058) so the button in Gmail or Outlook works directly. On unsubscribe the address is kept on a suppression list rather than deleted — that record is what guarantees you are not added back by mistake by a later import. If you would rather it were deleted outright, ask, and it is.
Who sees it. The address is held in TPTH’s own database and passed to the email provider in order to deliver the issue. It is not sold, rented, shared, or used to enrich any other record.
No. TPTH holds no independent assurance report or certificate and does not claim one. What exists is a documented, self-assessed control profile mapped to NIST CSF 2.0 at subcategory level, with evidence references — available under NDA. An independent assessment will be evaluated once the items at §10 close.
SOC 2 Type I vs Type II: a Type I opines on whether controls are suitably designed at a point in time; a Type II tests whether they operated effectively over a period, usually 3–12 months. Type II is the stronger evidence, and the coverage period is what you should check first on any vendor's report.
The free BEACON class asks for an email address before a viewing link is issued. The address goes on the Fourth Party subscriber list (confirmed opt-in, unchanged), and on the same record we keep the date it first opened the class, the date it last opened it and the number of times. The purpose is to open the class, send Fourth Party and follow up about BEACON training. We do not record a name or a network address on that record, and the viewing link, which lasts four hours, is not stored. The viewing dates and count are cleared 12 months after the last view. The video is private on Cloudflare Stream and plays only through a link our code issues.
The free VAULTS training asks for an email address before a viewing link is issued. The address goes on the Fourth Party subscriber list (confirmed opt-in, unchanged), and on the same record we keep the date it first opened the training, the date it last opened it and the number of times. The purpose is to open the training, send Fourth Party and follow up about training. We do not record a name or a network address on that record, and the viewing link, which lasts four hours, is not stored. The viewing dates and count stay on the subscriber record and are deleted with it. The full video is private on Cloudflare Stream and plays only through a link our code issues; the short trailer is public.
A sub-processor is any third party that stores, processes, transmits or may access customer data while TPTH delivers its services. A video platform qualifies because assessment interviews and training sessions carry customer information, even when nothing is recorded. TPTH lists it rather than taking the narrower reading — a vendor that discloses only its storage providers is giving you an incomplete picture of where your information goes.
Suppliers that do not touch customer data — an accountant, a general-purpose tool with no customer data access — are managed internally but are not listed here.
Only if you are comfortable with it. TPTH uses the meeting assistant built into its video conferencing platform, chosen over a standalone product because its terms exclude submitted content from model training. It is never enabled to join automatically, participants are told before it joins, and it is not admitted if anyone objects. If your organization instructs that its information must not be processed by AI tools, that instruction is recorded in the engagement file and the assistant is not used on any session concerning you.
It is also never admitted to a session where unremediated vulnerability detail about you or your vendors is discussed, regardless of whether you have given a general instruction. Most vendors do not disclose their meeting assistants at all; TPTH treats it as a sub-processor because that is what it is.
Yes, subject to review. Where your requirements exceed this manual, your contract governs for your engagement and the difference is recorded in the engagement file — TPTH does not sign a commitment it cannot meet and then manage the gap quietly. If a specific clause is not achievable at this firm size, it will be raised during contracting rather than discovered during an incident.
Only under the controls at Manual §20. An AI tool may be used for Company work only after approval and inventory entry, and only where its terms contractually exclude submitted data from model training if any customer data may be involved. Restricted customer data — assessment findings, unremediated vulnerability information, NDA material — may not be submitted unless those conditions are met and any contractual disclosure or consent requirement has been satisfied.
If you instruct that your data must not be processed by AI tools, that instruction is recorded in the engagement file and is absolute. Consumer or free-tier AI services are never used for work involving customer data, and a human is accountable for every deliverable.
By an absolute prohibition on secondary use, at Manual §13.3. Knowledge of a vendor's weaknesses obtained during one engagement is never used, referenced or hinted at in another — not in a report, not in training content, not in conversation. Engagement data is also segregated by engagement, access is granted per engagement, and it is revoked at closure.
This matters more for TPTH than for most vendors: the nature of the work means it accumulates knowledge about the security posture of organizations that are not its clients. Treating that knowledge as the client's property rather than the firm's is the controlling principle.
Restricted engagement data is retained for 90 days after the engagement, and deliverables for 12 months, unless your contract specifies otherwise — in which case the contract governs. On request, TPTH returns or destroys the data and issues a written certificate of destruction identifying what was destroyed, the method, and the date.
Destruction is by cryptographic erasure or physical destruction for electronic media, provider deletion for cloud-held data, and cross-cut shredding for physical records.
It is the most significant continuity risk to the firm and is disclosed as such rather than smoothed over. Short absences are handled by renegotiating milestones. Extended absence triggers assessment of whether engagements can transfer to a qualified subcontractor, subject to your consent and any contractual restriction on subcontracting. Emergency access arrangements are being formalised alongside the password manager deployment at §10 item 3, so that customer data and obligations are not stranded. Engaging an Associate (first engaged October 2026) does not by itself create emergency access or succession, and it does not change this answer.
Customer contracts address termination, deliverable handover and return of customer data, so you are not dependent on the principal's availability to recover your own material.
Because the alternative is worse evidence. TPRA's own guidance warns vendors against overstating compliance, and TPTH's business is helping organizations detect exactly that in their vendors. A trust center that lists only strengths tells you nothing about whether the firm knows where it stands.
A gap with a named owner and a target date is evidence of a functioning risk program. A gap you discover in month four of an engagement is evidence of the opposite.
Every material change to a published artifact is recorded here. Reviewed quarterly and updated on any material change — next scheduled review 2026-12-11.
| Date | Version | Change |
|---|---|---|
| 2026-10-21 | 1.25 | Two paid on-demand courses added to the site; no provider added or removed. The courses “Your Core Provider Playbook” and “When Your Vendor’s Vendor Fails” are sold on the website for $99 each through Square, which is already listed and acts as an independent controller of payment details. After a sale the Worker records the buyer’s email address, the Square payment and order IDs, the amount, the course, the access end date and viewing dates and counts, in the existing NEWS_DB database on Cloudflare. Access is by an emailed link valid 12 months, sent through Resend, and the video and paid toolkit files are served only behind that link (Cloudflare Stream, already listed). Retention: the purchase record is kept for the access period plus 90 days; then the email address, key hash and viewing data are erased automatically by a daily job and the payment facts stay as the sales record for 7 years. The Privacy Notice (effective date 2026-10-21) gains the matching collection and retention rows. A 7-day refund policy applies. No control or commitment changes. |
| 2026-10-21 | 1.24 | Scope sentence corrected: no region of delivery is claimed; no provider added or removed, and the count stays at eleven. §1 said “Delivery occurs in the United States and the European Union.” The sentence overstated where TPTH operates and is removed. The scope list itself is unchanged. The same release removes the claim of delivery from the European Union from the site footer and the Privacy Notice (section 01). The public company fact sheet, the Associate fact sheet and the website are corrected the same day: they no longer carry four client results (a vendor-review-time figure, a count of AI vendors surfaced, an AI-agent accuracy figure and a count of assessments), nor the related counts of findings closed, AI vendors assessed and contract clauses updated, for which TPTH holds no evidence file or written client permission. The “Outcomes” tile blocks now show founder facts or are removed, and the case-studies section is removed until a case study with written client permission exists. No control, sub-processor, retention period or commitment changes. |
| 2026-10-21 | 1.23 | Human check added to public forms; no provider added or removed, and the count stays at eleven. After bots flooded the newsletter sign-up between Oct 17 and Oct 21, 2026, the sign-up, contact and pack forms now use Cloudflare Turnstile. No new sub-processor: Cloudflare is already listed at §5 and its row now names the check. The telemetry disclosure and the Privacy Notice (new effective date 2026-10-21) now describe it, and the statement that the site sets no cookies is narrowed to cookies of our own, because the check runs in a Cloudflare-served frame whose browser storage is described in Cloudflare’s own addendum. The Privacy Notice also corrects its statement that form data is not stored in a database. |
| 2026-10-21 | 1.22 | The first Associate engaged; the personnel statements that described a one-person firm are updated; no provider added or removed, and the count stands at twelve. TPTH engaged its first Associate under a written agreement executed Oct 15, 2026. Four places on this page still described a firm with no one else in it, and each now says what is true. §2 says the role aliases still route only to the Chief Executive Officer and that no Associate monitors them. §4 no longer implies the first access review is a 2027 event: the first access-review record is planned to be a VAULTS™ review of the first Associate’s access, planned by Nov 6, 2026 and not yet performed, with the first semi-annual cycle still due 2027-03-11. §10 item 6 records that engaging an Associate does not remove the segregation-of-duties limitation, because an Associate delivers work under the controls and does not operate or approve them. The §11 answer on the principal being unavailable says the same about continuity. Gaps named rather than left for an assessor to find. Associate mailboxes run on Microsoft 365 bought through GoDaddy. That reseller tenant keeps three controls out of reach: tenant-wide MFA enforcement, a block on user consent to third-party applications, and Conditional Access. The MFA statement in §3 is reworded to match: MFA is switched on per user and confirmed at first sign-in, not enforced by the tenant. As of this version the first Associate’s mailbox and device enrollment are not complete and he does not sign in to TPTH systems until they are; device enrollment is not claimed anywhere on this page. What this version does not claim. It does not name the Associate, does not cite an access review as done, and does not say any device is enrolled. The VAULTS review will be recorded here, with the access-review row at §4, when it is performed. The Privacy Notice does not change: no new category of personal data is collected and no sub-processor is added. |
| 2026-10-20 | 1.21 | A second free training and a second email-gated download published with the change; no provider added or removed, and the count stands at twelve. The free VAULTS training goes live on 2026-10-20. It asks for an email address, signs the address up to Fourth Party on the existing double opt-in, and issues a four-hour viewing link for a private video hosted on Cloudflare Stream; the short trailer is public. The subscriber record gains three fields, first view, last view and number of views, on the same pattern as the BEACON class. The Core Provider Toolkit, two free working files for an email address, goes live the same day on the existing pack sign-up table and emails, with the same unsubscribe and no open or click tracking. No new sub-processor. Cloudflare Stream is part of Cloudflare, already listed at §5, and the Cloudflare row is widened to name the VAULTS training and its viewing fields. The Privacy Notice takes a new effective date of 2026-10-20 and gains the matching collection row, a retention row and a sentence on video hosting; its BEACON pack rows now also cover the Core Provider Toolkit. The viewing fields stay on the subscriber record and are deleted with it; no fixed clearing period is promised until the automated purge ships. |
| 2026-10-18 | 1.20 | A new processing purpose published with the change; no provider added or removed, and the count stands at twelve. The free BEACON class went live on Oct 18, 2026. It asks for an email address, signs the address up to Fourth Party on the existing double opt-in, and issues a four-hour viewing link for a private video hosted on Cloudflare Stream. The subscriber record gains three fields: first view, last view and number of views, so that a person already on the list who watches the class is recognized. Retention for those fields is 12 months from the last view. No new sub-processor. Cloudflare Stream is part of Cloudflare, already listed at §5, and the Cloudflare row is widened to say so and to name the new fields, as version 1.14 requires when an existing row takes on new processing. The Privacy Notice takes a new effective date of Oct 18, 2026 and gains the matching collection and retention rows and a sentence on video hosting in the same change. |
| 2026-10-15 | 1.19 | One retention period for training records; no control, sub-processor or commitment changes. Two statements disagreed. §6 and the Privacy Notice held training participant records for “the certification validity period plus three years”, while the CATRP ethics attestation and course exam results were kept five years from the date taken. With CATRP valid for three years, the first rule meant six years and the second five, and “validity period” was not defined anywhere. Both now read the same: training records, attestations and exam passes are kept five years from the latest certificate, attestation or renewal date, then deleted. A three-year credential stays confirmable for two years after it lapses, and a renewal restarts the clock. The Privacy Notice takes a new effective date of Oct 15, 2026, and Information Security Policy Manual §6.5 is amended to match. |
| 2026-10-13 | 1.18 | Two stated counts corrected; no control, sub-processor, retention period or commitment changes. The footer of this page read “Version 1.15” through versions 1.16 and 1.17 — the same class of stale stamp corrected at versions 1.4 and 1.12 — and now matches the stamp at the head of the page. Separately, the site’s home page described “5 open gaps, each with a target date.” §10 lists six items: one closed (insurance, in force since Sep 18), four open with target dates, and one disclosed limitation with no target date because it cannot be remediated at the firm’s current size (segregation of duties). The home page now reads four open gaps with target dates plus one disclosed limitation. §10 itself is unchanged. |
| 2026-09-25 | 1.17 | Course exams moved online; no provider added or removed, and the count stands at twelve. The certification exams for AI for TPRM Professionals, the Security Agent Mesh Masterclass and Securing SaaS Applications are now taken on the site and marked on TPTH’s server, as the CATRP ethics attestation has been since version 1.10. A pass is recorded on exactly the same terms — name, email, the exam, score and date, kept five years, used to issue and later confirm the certificate — and a failed attempt is not recorded. Because none of these exams is proctored, four controls stand in for a proctor on all of them, the attestation included: the candidate signs, by typing their name, that they are the registered person and are sitting it alone, and the signature is kept with a pass; the answer key and rationales are shown only after a pass; each exam allows three attempts in 24 hours, enforced with a hashed counter that deletes itself after a day; and every pass is checked against the enrollment or attendee list before a certificate or credential is issued. The record sits in the existing Cloudflare D1 training database, so §5’s Cloudflare row and the §11 answer on training records are widened to say so, including the attempt counter, and the privacy notice takes a new effective date of Sep 25, 2026. Published with the change, before the first pass is recorded. |
| 2026-09-25 | 1.16 | Resend’s assurance moved from published claims to documents read; no provider added or removed, and the count stands at twelve. The SOC 2 Type 2 report, the penetration-test attestation and the signed DPA were obtained and reviewed, and §5 now records what they actually say: an unqualified Security-only opinion for February 2025 to February 2026, one logging exception with remediation stated by management but not yet re-tested, an independent penetration test with no open findings, and DPA terms including a fourteen-day sub-processor notice and a breach commitment with no numeric period. Two limits are published with the result: the audit covers the Security criteria only, and it gives no assurance over most of the provider’s downstream infrastructure, including RunPod. Corrections. The Resend row named “Resend Labs, Inc.”; the contracting entity in the audit report and DPA is Plus Five Five, Inc., and the row now says so. The Square row gains the reason it is recorded as not material — card data is processed by Square as an independent controller under its own PCI DSS scope and never reaches TPTH — so that the exception to the pattern set in version 1.14 is stated rather than left for an assessor to query. AI in the fourth-party path, made permanent. Resend’s AI sub-processors, Anthropic and RunPod, were disclosed in an earlier change-log entry. They are now also stated in §5 itself, where a reader of the register will find them without reading the history. |
| 2026-09-25 | 1.15 | BoldSign added; the list goes from eleven named providers to twelve. Electronic signature, engaged Sep 24 for mutual NDAs and for associate and subcontractor agreements. It is recorded as material: it holds the content of executed NDAs and contracts, which is Confidential, and an audit trail carrying each signatory’s name, email, IP address and device. No client engagement data or assessment findings go through it. The assurance position is published as found, including the part TPTH cannot yet stand behind. The provider was described internally as “having a SOC 2”. What is actually published is a page stating a SOC 2 Type 2 over a twelve-month window by an unnamed independent CPA organization, with no audit period, no report date and no trust portal; the report is released only through a request form its legal team reviews. TPTH has not obtained or read it. The register therefore records the SOC 2 as claimed and documented but unverified rather than as held, and will be corrected once the report has been read. Recording a vendor’s certification on the strength of hearsay is the specific failure TPTH assesses other firms for, and it would be indefensible to do it here. What else is published, and what is not. No ISO/IEC 27001 is claimed. Penetration testing is stated to be performed in-house rather than by an independent third party. An Article 28 DPA is public and self-serve with the EU SCCs incorporated, and a sub-processor list is published with processing regions. Breach notification is “without undue delay” with no numeric commitment. Two further items are disclosed because an assessor would find them: the parent operates a development affiliate in India whose access to production is not addressed in any published document, and TPTH’s own account is on a free plan opened under a personal rather than a Company address, which is being corrected. An AI capability reads the documents. The provider’s form-field detection parses uploaded files, so an AI service processes NDA and contract content. The published position — zero-data-retention requests, no storage by the AI provider, no training on customer data, sub-processors named as Azure OpenAI and Google Cloud Vertex AI — is recorded as published rather than verified, and the capability is assessed under BEACON™ like any other vendor AI feature. §19.3 due diligence is outstanding and is tracked as such. |
| 2026-09-24 | 1.14 | Two §5 rows corrected; no provider added or removed, and the count stands at eleven. A review of the register against what the site actually runs found that the entries for Cloudflare and Resend had fallen behind the processing they now carry. Versions 1.10 and 1.11 each concluded, correctly, that the ethics attestation and the newsletter introduced no new sub-processor — both were already listed. What neither entry did was revisit what those existing rows said they held, and both rows said they held nothing personal. Cloudflare. The row read “public content only, no customer data”. That was true when it described DNS, CDN and static hosting. It stopped being true on Sep 19, when the CATRP attestation record moved into Cloudflare D1, and again on Sep 20 when the Fourth Party subscriber list followed. Cloudflare now holds, at rest, subscriber email addresses and attestation records carrying a candidate’s name, email, score and date — Confidential training records under §1. The row now says so, and the provider is reclassified as material. The comparison that settles it is SimpleMDM, which this register has called material since version 1.6 for holding a disk recovery key and no customer data at all; a provider holding the records themselves cannot be less material than one holding a key to them. Resend. The row described contact-form and resource-download mail. It now also carries every Fourth Party confirmation and issue — which means subscriber addresses, one recipient per send — and the internal notification raised when an attestation is passed, which contains the candidate’s name, email and score. The row is corrected and also reclassified as material. The 30-day provider retention is unchanged and still matches the Privacy Notice. Why this is published rather than quietly amended. Nothing new was engaged and no data went anywhere it should not have. The failure was one of description: the register kept its provider list current and let two of its own rows go stale, so for five days this page understated what two providers held. An assessor comparing §5 against the processing described at §1 and in the Privacy Notice would have found the gap, and finding it here is better. The standing lesson is recorded with it: a new processing purpose requires the existing rows to be re-read, not only the provider list to be checked for omissions. Privacy Notice corrected in the same change. The newsletter entries added on Sep 20 were added alongside the original ones rather than replacing them, leaving the notice stating both that the newsletter collects “name and email address” and that it collects the email address only and records no name. The database holds no name column; the superseded rows have been removed. §19.3 due diligence for the two reclassified providers is outstanding and is tracked as such. |
| 2026-09-23 | 1.13 | Wording only. The §5 cross-reference added at version 1.12 called Access & Data and Contractual Accountability “questions” of BEACON™. They are two of its six categories, each anchored to one question, and the site publishes a separate set of six written questions for vendors already under contract. The word is corrected so a reader cannot confuse the two. No change in substance. |
| 2026-09-23 | 1.12 | Two defects in this page’s own record, corrected and logged. Version 1.11 was published on Sep 20 with the version stamp moved but no entry in this log. That entry is backfilled below, dated to the change it describes and marked with the date it was written, rather than dated today as if nothing had been missed. Separately, the footer of this page read “Version 1.7” through versions 1.8 to 1.11 — the same class of stale stamp corrected at version 1.4 — and now matches the stamp at the head of the page. §5 gains a cross-reference. The AI meeting assistant controls now link to BEACON™, TPTH’s vendor AI risk framework, published on this site the same day. The withdrawal recorded at version 1.2 is cited on that page as the framework applied to TPTH itself, and a citation that cannot be followed back is only half a record. No control, sub-processor, retention period or commitment changes in this version. |
| 2026-09-20 | 1.11 | Newsletter processing described before the first issue. Fourth Party, TPTH’s weekly letter, now takes subscriptions on this site. §11 gains an answer to what TPTH does with an address given to it: the address itself, the dates of signup and confirmation and which form was used, and nothing else. Subscription is by confirmed opt-in; there is no open or click tracking and no IP address or device signal is stored; every issue carries a one-click unsubscribe (RFC 8058), and an unsubscribed address is kept on a suppression list so that it cannot be added back by mistake. No new sub-processor. Subscriber records are held in Cloudflare D1 and mail is sent through Resend, both already listed at §5. The Privacy Notice gained the matching purpose and retention rows in the same change. This entry was written on Sep 23, 2026 and published at version 1.12; see that entry. |
| 2026-09-19 | 1.10 | A new processing purpose published before it started processing. The CATRP ethics attestation moved online and is now recorded. That creates a class of personal data this page had not described, so §11 gains a plain statement of what is kept about a student, what is not, why, and for how long — written before the first record was written rather than after somebody asked. What is recorded: name, email, score and date, on a pass only, retained five years and then deleted. What is deliberately not recorded: the answers given, which questions were missed, time taken, and any device, browser or network signal. A failed attempt is not recorded at all and leaves no trace; the attestation can be retaken without limit. That is a design decision, not an omission — a history of a person’s failures serves no purpose TPTH has, so it is never created. Grading moved off the candidate’s browser. The exam was supplied as a self-contained page that marked itself, which meant the answer key was readable by anyone who opened the page source. Marking now happens server-side and the key is never sent to the browser. The limits are stated on the page rather than implied away: there is still no proctor and no identity check, so this is an attestation and TPTH does not describe it as a proctored examination. No new sub-processor. The record is held in Cloudflare D1, and Cloudflare is already listed at §5; the notification uses Resend, already listed at v1.8. §5 is unchanged and the count stands at eleven. The Privacy Notice gains the matching collection purpose and retention row in the same change, because a Trust Center that describes processing the privacy notice does not is the kind of self-contradiction §12 exists to catch — and this page created one of those earlier the same day. |
| 2026-09-19 | 1.9 | The migration moved the host; the register caught up. The company website, including this Trust Center, moved from GoDaddy Website Builder to Cloudflare Workers on Sep 19, 2026, and authoritative DNS moved to Cloudflare the same morning. Cloudflare, Inc. is added to the §5 sub-processor list for DNS, CDN and WAF, website hosting and cookieless web analytics, and is identified there as the host of this page. GoDaddy is narrowed to domain registration only; its row previously read “domain registration and website hosting, including this Trust Center”, which stopped being true at the moment of cutover. The registrar transfer is scheduled separately and that row closes when it completes. Two defects are recorded rather than quietly fixed, because §12 exists to catch exactly this class. The sub-processor count on the summary tile read “9 named” against a table of ten. Resend was added at v1.8 and the tile was not moved with it; it now reads eleven and matches the table. And for roughly two hours on Sep 19 this document contradicted itself: the telemetry disclosure had been updated to say Cloudflare already hosts this site, while the §5 table still named GoDaddy as the host. A register that disagrees with itself is worse than one that is merely out of date, because a reader who notices cannot tell which half to trust. Also published: credential verification returned to self-service at /verify. Twenty-eight issued certificates carry that address on their face; the page was lost in the migration and the site had substituted an email request, which is not what the certificates promise. The register holds one-way hashes of credential ID and surname — no names, no addresses — and the check runs in the visitor’s browser, so TPTH does not learn who verified a credential or when. |
| 2026-09-17 | 1.8 | SimpleMDM due diligence closed; one sub-processor added; an AI supply-chain disclosure made that no one asked for. SimpleMDM — §19.3 due diligence complete. v1.6 added SimpleMDM and Apple to this list and recorded that §19.3 due diligence was outstanding for both. It is now complete for SimpleMDM. PDQ.com Corporation supplied a SOC 2 Type 2 report examined by Baker Tilly US, LLP covering Sep 1, 2024 to Aug 31, 2025, with an unqualified opinion and no exceptions noted against any tested criterion, and SimpleMDM named in scope rather than inferred from a broader product family. Three limits are recorded rather than glossed. The attestation covers the Security trust services category only, so availability, confidentiality and privacy rest on the Data Processing Agreement instead. It is a carve-out report, so parts of the service chain behind SimpleMDM were not examined by it and TPTH’s assurance stops at the vendor’s own boundary; the organizations concerned are identified in the report, which is restricted-use, and are available to customers under NDA. And its coverage period ended more than twelve months ago — stated here so the reader can weigh it, because §11 of this page tells assessors to check the coverage period first and it would be poor practice to publish a date that invites the question and then not answer it. The report is restricted-use and is not republished. The vendor’s own sub-processor change-notice commitment is shorter than the 30 days TPTH gives above. The specific term is governed by a Data Processing Agreement whose confidentiality clause permits TPTH to disclose that the agreement exists but not what it says, so the figure is not published here and is available to customers under NDA. TPTH compensates with a quarterly reconciliation against the vendor’s published sub-processor list, which caps the blind spot at one quarter regardless of what the vendor commits to — and that control has already proved its worth in a way that is recorded in the internal file rather than here. Apple remains outstanding and is unchanged from v1.6. Resend added — one sub-processor, disclosed before it processed anything. The website contact form and a new resource-download form send mail through Resend Labs, Inc. Unlike the additions at v1.6, this one is listed on the day it was engaged rather than surfaced later by inventory reconciliation. Due diligence was performed before adoption: SOC 2 Type II covering Feb 1, 2025 to Feb 1, 2026 across all five trust services categories, audited by Advantage Partners; a Data Processing Agreement binding on acceptance that incorporates the EU Standard Contractual Clauses as well as the EU-U.S. Data Privacy Framework and the UK Addendum; and a published 30-day retention period for message data. The SCC position is worth naming because it is the one TPTH could not obtain from the vendor above: a transfer basis that survives the Data Privacy Framework being annulled the way its two predecessors were. Two asymmetries are recorded. The provider commits to 14 days’ sub-processor notice against the 30 TPTH gives, and to breach notification “without undue delay” without a stated period. It is listed as not material: it carries names, work email addresses and organizations supplied to a public form, and no customer engagement data. The Privacy Notice states the same 30-day retention, which is the provider’s own published period rather than an aspiration — a commitment that outran the processor holding it would be worse than no commitment. AI in the fourth-party path — disclosed unprompted. Resend’s published sub-processor list names Anthropic PBC and RunPod, Inc., so there is an AI capability in the chain behind the website’s contact and download forms. Nothing requires TPTH to publish that: they are the vendor’s sub-processors rather than TPTH’s, the data is a name, a work email and an organization, and no customer engagement material goes near it. It is published because TPTH now distributes a handout asking vendors to name the third parties that provide or access their AI, and a firm that asks that question and then waits to be asked it has answered nothing. The same controls at §19.7 governing AI meeting assistants do not apply here — no AI acts on TPTH’s behalf in this path — but the disclosure belongs on the record either way. Also corrected: this page’s own version was misstated elsewhere on the site. The website home page advertised the Trust Center as v1.2 while this document stood at v1.7 — a hardcoded value that had not moved in five revisions. It now reads the version from this document, so the two cannot drift again. Minor, and exactly the class of error §12 exists to catch: a number that describes another number is wrong the moment nobody re-checks it. |
| 2026-09-13 | 1.7 | Policy manual reissued at v1.3; two mirrored tables corrected. Appendix B of TPTH-ISMS-001 mirrors the control gap register in the CSF workbook, and Appendix E is the document register. Both had fallen behind the registers they mirror, and the gated packet therefore described two controls differently from this page. Gap item 2 recorded a target of “Closed Sep 18, 2026” — a date still in the future, which stated the insurance control as complete before it was in force. It now reads as bound Sep 11, 2026 and in force Sep 18, 2026, matching §8 of this page. Gap item 3 still carried the superseded remediation for emergency credential access — designate an Apple Account Recovery Contact — which due diligence showed does not close the gap, because Apple excludes iCloud Keychain from legacy access and no Apple mechanism returns Company credentials to a second party. It is replaced by the corrected four-step position already published at §10 and recorded in the workbook. Appendix E is brought current: TPTH-BRT-001 to 1.3, following correction of the Google Drive mirror path in its first verification gate, and this Trust Center to 1.7. The twenty-one policy cards at §3 now read manual version 1.3. Logged rather than corrected silently: a register that mirrors another register drifts unless the drift is recorded. |
| 2026-09-13 | 1.6 | Data handling claim qualified. §1 previously stated that Restricted data is stored only in Company-managed tenants and is never placed on personal devices. Read strictly that was not accurate: client email reaches a Company-managed mobile device, so local and cached copies exist outside the tenants. The claim now describes the control that actually applies — local copies only on Company-managed, MDM-enrolled endpoints with full-device encryption, enforced passcode and remote wipe — and keeps the absolute prohibitions that are true, namely removable media, personal or unmanaged devices, and consumer file-sharing accounts. TPTH-ISMS-001 §6.3 storage rule amended to match. Published because an assessor would find the gap, and a trust page that overstates one control invites doubt about the rest. Three sub-processors added; the list goes from six named providers to nine. Neither was newly engaged — both were already in use and neither had been disclosed, which the asset inventory reconciliation of the same day surfaced. SimpleMDM provides mobile device management for the Company endpoints; it receives device inventory and configuration metadata and no customer data, but it holds device-management control over the endpoint that handles Restricted data, so it belongs on this list. Apple provides iCloud Keychain as the credential store and device backup for the Company mobile endpoint. Advanced Data Protection was enabled on Sep 13, 2026, so backup content is end-to-end encrypted and Apple holds no key to it. Both are recorded in TPTH-ISMS-001 §19.6 and in the sub-processor register, and §19.3 due diligence is outstanding for both. §10 item 3 moved to in progress. An Apple Account Recovery Contact has been designated. The item is not closed: a recovery contact addresses account lockout where the owner is present, not the unavailability the gap describes. The remaining steps are stated on the item rather than implied. Due diligence completed for both new entries. SimpleMDM is recorded as material — it receives no customer data, but it holds the disk recovery key for, and can execute scripts on, the endpoint that handles Restricted data, so its compromise would matter as much as a provider that holds the data itself. Apple is accepted on the basis of encryption rather than contract: with Advanced Data Protection enabled the provider holds no key to either service in scope, and no Article 28 data processing agreement is available for a personal Apple Account — a limitation stated here rather than left to be discovered. Buzzsprout (Higher Pixels, Inc.) hosts the public podcast. It receives no customer data and is not material, but it was in use and undisclosed, and it is listed for the same reason as the others. Its assurance position is recorded as found rather than as hoped: the provider states it holds no SOC audit of its own, its database contents are not encrypted at rest, and no data processing agreement is offered. None of that touches customer data, and saying so is more useful than omitting the entry. |
| 2026-09-13 | 1.5 | AI meeting assistant — corrections restored. Changes published at version 1.2 on Sep 12 were not carried forward into versions 1.2 to 1.4, which were prepared from the Sep 11 text. They are restored here and the record is corrected rather than quietly rewritten. The standalone AI meeting assistant previously listed at §5 was withdrawn on Sep 12, 2026, because its terms did not exclude submitted content from model training — its published position was that training is opt-in with an opt-out-by-default improvement program, which is not an exclusion and does not satisfy Manual §20.2. The provider has confirmed in writing that the data it held was deleted. Its replacement is the assistant built into the video conferencing platform already listed at §5, whose Terms of Service do carry that exclusion; two limits of that clause are published alongside it. The statement that provider terms were confirmed to exclude training content was incorrect for the former provider and is withdrawn. No standalone AI service remains on the sub-processor list, which falls from seven named providers to six. The assistant is never enabled to join automatically: it is admitted only where TPTH deliberately invites it to a specific session, published as the first control at §5 and at Manual §19.7. Other corrections. §1 insurance highlight brought into line with §8 and the risk register: $1M per occurrence with a $2M general liability aggregate, shared cyber sublimits, and dependent business interruption and dependent system failure excluded. §3 BC/DR card aligned to the 4-hour client communication RTO published at §7. §10 gap 2 no longer records a closure on a future date. |
| 2026-09-13 | 1.4 | Stale metadata corrected. Version 1.3 updated the footer but left the version stamp at the head of this page reading 1.1, and left §3 describing the policy manual as v1.0 when it had been reissued twice the same day. Twenty-two policy cards carried the superseded version and revision date. All are corrected. Separately, §3, §4 and §6 stated that 75 CSF subcategories were profiled while the summary tiles stated 76 — the correct figure is 76 and the prose was wrong. Sub-processor register re-dated to reflect the corrected Google entry. Logged as its own version rather than folded into 1.3, because a page that commits to publishing what changed should not quietly edit itself. |
| 2026-09-13 | 1.3 | Insurance disclosure corrected. §8 previously listed cyber crime, system failure, reputational harm and enhanced privacy regulation as inclusions under the $1,000,000 cyber limit without stating that each is sublimited and shared. Read plainly, that overstated the cover. The full sublimit schedule is now published, together with two exclusions that matter to anyone assessing TPTH: dependent business interruption and dependent system failure are not covered, and the retroactive date equals inception so there is no prior acts cover. TPTH-ISMS-001 and TPTH-BCDR-001 reissued at v1.2, TPTH-IRP-001 at v1.2 with the insurer sublimits and the out-of-hours breach hotline, and the CSF profile entry for GV.RM-04 amended to record the limits of the risk transfer rather than the fact of it. |
| 2026-09-13 | 1.2 | Platform description corrected. Earlier versions described TPTH as operating a managed Google Workspace tenant. It does not. The Google account in use is a consumer Gmail and Drive account. §2 scope and the §5 sub-processor entry are corrected, and §10 item 1 no longer cites Workspace retention. The correction matters to assessors because a consumer account has no administrative console, no exportable audit log and no administrator-initiated restore, so three capabilities previously implied are not available. TPTH-ISMS-001, TPTH-IRP-001 and TPTH-BCDR-001 were reissued at v1.1, and TPTH-BRT-001 at v1.2, to match. Backup. First encrypted external drive installed and Time Machine configured Sep 13, 2026. Restoration testing not yet performed; §10 item 1 remains in progress. |
| 2026-09-11 | 1.1 | Insurance. Gap register item 2 closed — cyber liability, professional liability and general liability bound with Hiscox at $1M limits, each effective Sep 18, 2026. §8 now publishes coverage categories and limits. The incident response plan was updated so that forensics and breach counsel are supplied by the insurer breach response panel, with the insurer notified ahead of any other external engagement. Control profile: 66 operating, 7 partial, 2 planned, 1 not applicable. Backup. Gap register item 1 moved from open to in progress. Approach selected: encrypted local backup with two drives in rotation, one held offsite, in preference to a managed service that would become a material sub-processor. Partial local coverage verified Sep 11, 2026 — mirrored Drive content, fully cached mail, Time Machine operating to an encrypted drive. Target revised to December 2026 to allow retention depth to accrue before the restoration test. No restoration test has yet been performed and none is claimed. §2. Added disclosure that the role addresses are aliases monitored by the Chief Executive Officer. |
| 2026-09-11 | 1.0 | Trust Center published. Initial issue of TPTH-ISMS-001 Information Security Policy Manual, TPTH-IRP-001 Incident Response Plan, TPTH-BCDR-001 Business Continuity and DR Plan, and TPTH-CSF-001 NIST CSF 2.0 Control Profile. Sub-processor list and Control Gap Register published. |
Telemetry disclosure. This site sets no cookies of its own, here or anywhere else on it. Aggregate page views and referrers are measured with Cloudflare Web Analytics, which is cookieless, stores nothing in your browser, does not fingerprint and does not record query strings; Cloudflare already hosts this site. The sign-up, contact and pack forms use Cloudflare Turnstile as a human check: its script loads only when a form is first used, it processes signals such as IP address and browser details to decide whether the visitor is a person, and it runs in a frame served by Cloudflare, already listed at section 5. There is no other analytics and no advertising or cross-site tracking. Access to gated artifacts is logged — requester, artifact and date — as a record of disclosure.
This Trust Center is the model for the one we build for our clients: every claim checked against evidence, every change dated and logged.
Trust Center Service →