Security

Trigon is built so that a company’s financial data is protected, access is controlled, and data is processed in a secure cloud environment. We factor security into the system architecture, user permissions and everyday development process alike.

Amazon AWS cloud infrastructure

Trigon runs on Amazon Web Services cloud infrastructure.

Data in Frankfurt, Germany

Trigon’s core data is stored in AWS’s Frankfurt region in Germany.

Role-based access

A user can see and do only what they have been granted rights to for a given company or organisation.

Security as part of development

The application’s security is checked as part of the development process, and we follow OWASP security practices during development.

Where and how is your data stored?

Trigon’s core data is stored on Amazon Web Services (AWS) in the Frankfurt region in Germany.

Trigon uses AWS cloud infrastructure to provide a scalable and reliable technical environment.

Data location

AWS Frankfurt, Germany.

Cloud infrastructure

Amazon Web Services.

How is access managed?

Using Trigon requires user authentication. You can sign in with an email address and password, or with a Google, Microsoft or Smart-ID account.

Once a user is identified, their assigned roles and rights determine their access to specific companies and activities. Trigon’s access management follows the principle of least privilege: a user can access only the data and activities their role requires.

Multiple sign-in methods

Email and password, Google, Microsoft and Smart-ID.

Role-based permissions

Access to companies and activities depends on the user’s assigned role and rights.

Least privilege

Access is granted only to the extent a user needs it for their work.

Access requires authentication

Only an authenticated user can reach Trigon’s protected data and features.

Security is part of the development process

The security of Trigon’s web application is checked and assessed as part of the development process. We follow OWASP security practices during development.

Security requirements are factored in when developing the system architecture, access controls and new features alike.

Security checks during development

The application’s security is checked and assessed as part of the regular development process.

OWASP principles

During development we follow the internationally recognised OWASP web application security principles.

An activity history helps maintain control

In financial work, the end result isn’t the whole story. You also need to be able to see who did what and how the work reached that point.

Trigon keeps an activity history that helps you trace important actions and decisions. This supports day-to-day oversight and helps you understand what happened, even when the people responsible or using the system change.

Activities stay traceable

The history of actions taken in the system is kept and can help reconstruct how a process developed, when needed.

Decisions stay with the workflow

Approvals, changes and other key actions can stay linked to the workflow itself, rather than living only in emails or people’s memory.

Easier handover

A traceable activity history helps keep processes understandable even when those responsible or using the system change.

Data security is a shared responsibility

Trigon’s security aims to protect the confidentiality, integrity and availability of the data processed in the system. For that, we use controlled access, role-based permissions and secure cloud infrastructure.

Trigon takes care of its environment and technical security measures. Your organisation, in turn, manages who is granted access and which rights users are given.

The principles of personal data processing are described in the privacy notice, and the rights and obligations of using Trigon are set out in the terms of use.

Privacy notice

How Trigon processes and protects personal data.

Cookie notice

Which cookies Trigon’s website uses and what for.

Sub-processors

To provide the service, Trigon uses the following service providers (sub-processors).

Amazon Web Services (AWS)

Infrastructure and data storage, Frankfurt, Germany.

CostPocket

Document digitisation. A document is held only while it is digitised and the result returned, and no person ever sees it.

SK ID Solutions

Signing in with Smart-ID.

GoCardless

Connecting bank accounts and bringing bank transactions into Trigon.

tawk.to

Customer support chat.

Plausible Analytics

Measuring website use without cookies or personal data.

Cal.com

Meeting booking calendar on the website.

Security questions