Version 2026-10-12. Owners and admins accept this addendum in their workspace, under Security. We record who accepted it, when, and the version.

1. Who this is between

This addendum is between Trilly (ABN 66 670 726 691, Suite 1208/530 Little Collins Street, Melbourne VIC 3000, Australia) and the company that runs a Trilly workspace ("you").

It adds to our terms and our privacy policy. If this addendum and those documents disagree about your staff's personal information, this addendum wins.

2. Who decides and who handles

  • You decide. You choose who joins your workspace, which skills they can use, and what your settings are. For your workspace, you are the controller (in the GDPR's words) or the organisation the information is about (under the Australian Privacy Act).
  • We handle it for you. For your workspace, Trilly is your processor. We only use your workspace information to run the workspace for you, following this addendum, your settings, and what your owners and admins do in the workspace.
  • People in your workspace also have their own Trilly accounts. What they do on Trilly outside your workspace (for example, buying a skill for themselves) is covered by our privacy policy, not this addendum.

3. What we process

What Examples
Who your people are Name, work email, role in the workspace, the groups they are in, whether they are active
How they sign in Records of company sign-in (SSO) and the provisioning updates your systems send us (SCIM)
Licences Which skills your company pays for, how many seats, who has a seat, requests and decisions
How skills are used Short notes from AI apps that a skill was used or finished, thumbs up or down, and the time. Never your staff's conversations with their AI
Feedback Written feedback your staff choose to send, if your workspace allows it
Billing Billing contact, purchase order numbers and invoices. Card details stay with Stripe
Security records The workspace audit log: who changed what, and when

We do not ask for sensitive information, and our skill rules forbid skills that collect it.

4. Why we process it

Only to:

  • run your workspace: sign-in, members, groups, seats, the approved list and private skills,
  • deliver the skills your people are allowed to use,
  • bill you and pay skill makers,
  • show you reports about seats and use,
  • keep Trilly secure, investigate misuse, and fix problems,
  • give you support when you ask.

We do not sell your workspace information, use it for advertising, or use it to train AI models.

5. Our promises

  1. Your instructions. We follow this addendum and your settings. If we think an instruction breaks the law, we tell you.
  2. Confidentiality. Only people at Trilly who need to see your workspace information can see it, and they must keep it confidential.
  3. Security. We protect it with the measures in section 9 and on our security page.
  4. Helpers (subprocessors). We use the companies listed in section 10. We will email your workspace owners at least 30 days before we add a new one. If you object for a good reason and we can't solve it, you can close your workspace and we will refund any unused prepaid amount.
  5. Your people's rights. If one of your people asks us to see, correct or delete their workspace information, we pass the request to you and help you answer it. Owners and admins can export workspace data at any time.
  6. Breaches. If we become aware of a breach that affects your workspace information, we will tell your workspace owners without undue delay, and within 72 hours where we can, with what we know and what we are doing about it. We will help you meet your own duties, including under the Notifiable Data Breaches scheme.
  7. Assessments. If you need to do a privacy impact assessment or talk to a regulator, we give you the information we reasonably can.
  8. Checks. Once a year (or after a breach) we will answer a reasonable security questionnaire. We do not hold security certifications such as SOC 2 or ISO 27001.

6. Your promises

  • You have the right to give us your people's information and to let them use Trilly, and you tell them how their information is used.
  • You keep your owner and admin accounts safe, and remove people who leave (or let your systems do it through SCIM).
  • You only put information into your workspace that you are allowed to.

7. Where the information is stored

Your workspace information is stored on Amazon Web Services in the United States (N. Virginia, us-east-1), with the other services listed in section 10. For people in the European Union and the United Kingdom, transfers rely on the standard contractual clauses (and the UK addendum), or another lawful transfer method. For Australia, we take reasonable steps under Australian Privacy Principle 8.

8. When you leave

  • Owners can export your workspace data at any time, under Security, including for 30 days after the workspace closes.
  • An owner can close your workspace under Security. Seats end straight away, company sign-in and provisioning stop, and your Trilly Teams plan and seat licences end when the period you've paid for ends. Your people keep their own Trilly accounts and anything they bought for themselves.
  • For 30 days after it closes, an owner can reopen the workspace. When those 30 days are up, we delete or anonymise your workspace information within a day: your people list, groups, approvals, private skills, company sign-in and provisioning settings and their secrets, and seat records.
  • We keep billing and tax records we must keep by law (at least 7 years), and the workspace audit log (who changed what, and when) as a security record.
  • Database backups are encrypted and roll off on their own within 400 days. We do not restore deleted workspace information from backups except to recover from a disaster.

9. How we protect it

  • Encryption in transit (HTTPS only, with HSTS) and for files and backups at rest (Amazon S3 with a Trilly-only encryption key).
  • Passwords are stored as one-way hashes, and sign-in tokens, provisioning tokens and one-time links are stored only as hashes. Company sign-in secrets are encrypted.
  • Access is limited: the website's database login can't change the database's structure or rewrite the audit log, and backups can't be read from the web server.
  • Every change in your workspace is written to an audit log that you can view and export.
  • Backups every night, plus every 15 minutes in between, with a monthly test restore.
  • Monitoring of the site's health, with alerts to our team.
  • Every skill is scanned and checked by a person before it is listed, and again on every update.

10. Our helpers (subprocessors)

Who What they do Where
Amazon Web Services Servers, database, file storage, email sending and file delivery United States (N. Virginia); file delivery copies worldwide for a short time
Stripe Payments, invoices and payouts to skill makers Australia and the United States
Fastmail Our own mailboxes, when you email us Australia, with servers in the United States
Anthropic Automated safety reviews of skill files (never your staff's conversations or workspace information) United States

11. How long this lasts, and the law

This addendum lasts as long as your workspace does, and the parts about deleting information last until it is deleted. It is governed by the law of Victoria, Australia, and the limits of liability in our terms apply.

12. Changes

If we change this addendum, we publish the new version here with a new version number and ask your owners or admins to accept it in the workspace. Until then, the version you accepted applies, unless the law requires a change sooner.

13. Contact

Privacy questions: privacy@trilly.io. Security reports: security@trilly.io.