Security and encryption
Stored provider credentials use AES-256-GCM. Read the implementation scope, key lifecycle, hosting region, rotation policy, and honest threat model.
Read security design →Reviewed August 18, 2026
TryTokka Trust Center
Product boundaries
- TryTokka is not a payment processor or the source of provider invoices.
- Scout alerts are not guaranteed hard budget stops or real-time request controls.
- Pricing and model-switch figures are estimates unless labelled as provider-reported billing data.
- TryTokka does not claim SOC 2, ISO 27001, HIPAA, PCI DSS, or another certification on this page.
- No security design eliminates all risk; the Security page documents current controls and remaining threats.
Trust directory
Subprocessors and privacy
Named vendors that process TryTokka data, including disaster-recovery backups. Same list as Privacy §4.
View subprocessors →Incident response
How a suspected breach is reported, contained, assessed, and published. Not a 24/7 SOC and not a timed-email guarantee.
Read the procedure →Retention and deletion
Retention depends on data type and legal obligations. What the account delete button removes vs what backups and tax records keep is on the Security page.
Read deletion guarantees →Service status
The public status page reports the checks implemented by TryTokka. It is not a contractual uptime SLA.
Open service status →Responsible disclosure
Security researchers can use the RFC 9116 security.txt contact and policy links. Do not include active credentials or personal data in a report.
Open security.txt →Billing accuracy
TryTokka distinguishes list-rate estimates, synced provider usage, and finalized billing records. Provider invoices remain the settlement source.
Read the accuracy framework →Founder and accountability
TryTokka names its founder and support channel. No customer count, funding, award, or team-size claim is implied.
Meet the founder →Terms, refunds, and payments
Read current subscription, refund-window, cancellation, and payment-provider terms before purchasing.
Read Terms of Service →Sources and verification
Claims are checked against the sources below. Provider prices and product features can change; verify the source before making a purchasing or production decision. Last checked 2026-08-20.
Entries shown as a file path point into TryTokka's application repository, which is not public — you cannot open those to check them yourself, and we would rather say so than link you to a page you cannot read. They are listed so the claim names the exact code it rests on. Everything else links to a primary source you can verify directly.
- Credential encryption implementation — TryTokka source (published for inspection); checked 2026-08-20Uses Node crypto aes-256-gcm, a random 16-byte IV, and an authentication tag.
- Provider sync dispatch —
infrastructure/providers/index.ts; reviewed 2026-07-18Provider adapters receive encrypted credentials and fetch usage out of band. - Vercel cron configuration —
vercel.json; reviewed 2026-07-18The deployed schedule is the source of truth; delivery time is not guaranteed. - Manual sync route —
app/api/connections/sync/route.ts; reviewed 2026-07-18Authenticated owners can request an on-demand sync. - OpenAI API pricing — OpenAI; checked 2026-07-18
- Claude API pricing — Anthropic; checked 2026-07-18
- Pinned model pricing catalog —
lib/model-pricing-catalog.ts; reviewed 2026-07-18Pins include a verification date and are checked by the pricing gate.
Found an outdated statement? Email legal@trytokka.com.
Ask or report
For product, privacy, or billing questions, use Support. For a suspected vulnerability, follow security.txt so the report reaches the documented contact.