Verifiable testimonials, without leaking the conversation.
Privacy isn't a feature here, it's the foundation. The chat is never published; only the parts you explicitly approve become public. Built for regulated industries.
The principle
The whole reason Truesaid exists is that fake testimonials are easy and verifiable testimonials are rare. Privacy is not optional here — if your clients can't trust that their conversation stays private, you can't use Truesaid at all. Everything on this page follows from that.
This page is the canonical reference for how Truesaid handles your data. It's deliberately long because regulated industries — lawyers, doctors, accountants, therapists, financial advisors — read this page line by line before signing up. Bookmark it; we keep it current.
Your conversation never gets published.
The chat content stays private
Truesaid never publishes the original messages. Only the testimonial you explicitly approve, the verbatim quotes you choose to highlight, and high-level metadata appear publicly.
Verification page — non-sensitive only
The public verification page (the one the QR code points to) shows: import date, source language, message count, integrity score. It does not show the chat, the client's phone number, or any private details.
Name display you control
For each client you can show their full name, just initials (e.g. J. P. B.), or hide the name entirely (blurred in exports and widgets) — your choice per client.
Right to delete
Delete a client and Truesaid drops everything: the imported chat, the testimonial, the excerpts, and the public verification page. The verification URL stops resolving.
Built for regulated industries.
Truesaid's privacy-by-default architecture (chat never published, hidden-name controls, immediate deletion) maps cleanly to the major regulatory regimes. The summaries below are factual; they are not legal advice. For matters specific to your practice, consult your regulator and your lawyer.
Where your data lives — and how it's protected.
The integrity checks behind the badge
"Verified" isn't a marketing word here. It's a chain of concrete checks Truesaid runs on the original file, recorded with the testimonial.
Every third party in the data path.
Truesaid uses these third parties to deliver the service. Each is selected for its security and privacy posture and operates under a written agreement. None receive data they don't need to perform their function.
We notify users at least 30 days before adding or changing a subprocessor, via email to active accounts.
What happens if something goes wrong.
Security is a process, not a guarantee. If we confirm a personal-data breach affecting your account, we follow a defined playbook:
- Contain — stop the breach, rotate credentials, isolate affected systems.
- Assess — determine which accounts and which data categories are affected.
- Notify — affected users via the email associated with their account, within 72 hours of confirming the breach (GDPR requirement).
- Report — to the relevant supervisory authority (AEPD in Spain, ICO in UK, etc.) where required by law.
- Remediate — root-cause fix, regression test, post-mortem published if material.
Cloudflare and Anthropic have their own incident-response procedures for the layers they operate. We coordinate with them when an issue spans the stack.
How long we keep things, exactly.
Questions we get asked the most.
For other questions, the general FAQ covers product-level topics; for legal text, see Privacy Policy and Terms of Service.
Is Truesaid GDPR-compliant?
Yes. Truesaid is operated from the European Union and treats every data flow under GDPR. You are the data controller for the conversations you upload; Truesaid is the data processor. We support the full set of data-subject rights (access, rectification, erasure, portability, restriction, objection, consent withdrawal). Cross-border transfers to subprocessors based outside the EU rely on Standard Contractual Clauses and / or adequacy frameworks where applicable.
Is Truesaid HIPAA-compliant for medical practices?
Truesaid is HIPAA-friendly by design (the chat content stays private, hidden-name mode anonymises the patient, deletion is immediate), but we do not currently sign Business Associate Agreements (BAAs) — you should treat Truesaid as a non-BAA tool and use hidden-name mode with no Protected Health Information for any patient testimonial. If your practice requires a BAA, contact us to discuss the roadmap.
What encryption does Truesaid use?
TLS 1.3 in transit for every connection (Cloudflare's edge enforces this — HTTP is automatically redirected to HTTPS). Cloudflare D1 (our database) encrypts data at rest using AES-256. Magic-link tokens are stored hashed (never in plaintext). Stripe payment data never touches Truesaid's database; Stripe is PCI-DSS Level 1 certified.
How long do you keep my data?
Account data: until you delete your account. Conversation files and generated testimonials: until you delete the client (deletion is immediate, no soft-delete or recovery window). Server logs: 30 days, then automatically purged. Magic-link tokens: 15 minutes maximum. Sessions: until you sign out or revoke them. Billing records: as required by tax law (typically 7 years).
Who has access to my conversations inside Truesaid?
You. Truesaid's operators do not access user conversations as a normal-operations matter. Access for debugging or support is request-driven and audited. We do not have a 'training pipeline' that reads user data. Anthropic's Claude API processes conversations during testimonial generation but does not retain them for training (per Anthropic's API data-handling terms).
What happens if Truesaid has a data breach?
Under GDPR, we notify affected users within 72 hours of confirming a personal-data breach. We notify you via the email associated with your account, describe what happened, what data was affected, and what we're doing about it. Cloudflare handles the underlying infrastructure and has its own breach-response procedures.
Do you do penetration testing or security audits?
Truesaid is in beta. We run static analysis on every deploy and rely on Cloudflare's edge-level DDoS, WAF, and bot-detection. A formal penetration test is on the roadmap before the formal v1 launch. The integrity checks (CRC, ZIP signature, DKIM) are themselves a continuous adversarial check on the inputs you upload.
Can I delete my account and all data immediately?
Yes. Account deletion is immediate from your dashboard. It removes: your user record, every client you imported, every conversation file, every testimonial, every excerpt, every widget you created, every public profile entry. The verification URLs stop resolving immediately. There is no undo and no recovery.
Will my client testimonials show up in Google search?
Only if you publish them on your public profile page (verydash.com/u/your-id) and you don't disable indexing. Per-account, you can toggle off indexability and the sitemap will exclude you. Per-testimonial, deletion stops everything: search engines reindex within days, the verification URL stops resolving in milliseconds.
What happens if my client asks to be removed from a published testimonial?
Delete that client in Truesaid. Within milliseconds: the public verification page returns 'verification not found', every embeddable widget hides the entry, every cached image with a QR code now points to a dead URL. Search engine cache lingers for days but the live URL is gone. This is the GDPR-compliant withdrawal-of-consent path.
Are you registered as a data processor in any jurisdiction?
Yes — we maintain GDPR-compliant data-processing records. For privacy enquiries, formal data-subject requests, or to ask for a Data Processing Addendum (DPA), use the support page with topic 'Privacy / data deletion'.
What about Stripe — is my payment information secure?
Truesaid never sees your card number. Stripe handles payment processing entirely; we receive only metadata (subscription status, last-four-digits-of-card for display). Stripe is PCI-DSS Level 1 certified — the industry standard for card-handling security.
Ready to turn a real conversation into a verified testimonial?
Sign in with just your email. No card, no password.
Get started →