Security and Trust

It is the most sensitive commercial data a shipper holds, and it is handled that way. Two things are worth asking any vendor in this category: is our pricing data visible to carriers, and can we verify your compliance framework without having to ask you for it. For freya by TetriXX AI the answers are no, and yes.

Yes, we are certified and independently assessed. The status of each, stated plainly rather than implied:

• ISO/IEC 27001, certified since July 2023. Renewal audit in progress.
• SOC 2 Type II, most recent report covering the period to 30 July 2025. Renewal audit in progress.
• GDPR, independently assessed, with Article 27 representation for the European Union and the United Kingdom by Prighter, verifiable on their portal. Renewal audit in progress.
• Penetration testing by a CREST-certified provider, most recent test June 2026, closing grade A+.

A renewal audit in progress is the ordinary state of a live certification programme rather than a gap in one, and it is a fair thing to ask any vendor to evidence rather than assert. The certificate, the scope statement, the report and the testing summary are provided as a documented pack through vendor review under NDA.

Beyond the certifications, client environments are isolated from one another, and encryption, key management and access control follow industry best practice. The framework itself is published at tetrixx.ai/legal, which is the part you should not have to ask us for, and data moves under signed NDA.

“Data security is not a feature at TetriXX. It is the foundation everything else sits on.”

TetriXX AI (published 19 May 2026)

No. Client data is not used to train or fine-tune AI models, and that is a contractual commitment rather than a policy statement. The one thing that ever feeds model improvement is strictly aggregated and anonymised data, from which no individual invoice, carrier rate, shipment record or identifiable commercial term can be extracted.

Client data also stays inside that client’s own environment and is not reachable from any other client’s, and no pricing data is shared with carriers or forwarders.

Model inference runs under enterprise data terms with named sub-processors, in the same region as the platform. The sub-processor register is maintained and provided under NDA, with the rest of the security documentation.

No. Every client gets its own environment: compute and storage are not shared between clients.

The mechanism behind that isolation, the hosting position and the residency commitment are answered through vendor review under NDA, and in the MSA and its exhibits.

You do, and you can take it with you. The data in your environment is yours, it is exportable in full at any time, in structured form, and there is no lock-in mechanism holding it inside the platform.

This matters more in this category than in most software: the asset being created is verified line-level freight data, and a vendor that makes it hard to leave with is charging you twice.

Yes: enterprise single sign-on, role-based access control and multi-factor authentication, with user provisioning handled through your identity provider. Every decision in the audit workflow is tracked in an exportable, SOX-ready audit trail. Configuration detail goes through vendor review.

Through vendor review, under NDA, as a documented set rather than a paragraph on a web page: the service level agreement with its measurement basis and service credits, the hosting and data residency position, the sub-processor register, and the penetration testing summary. Every one of those is a contractual commitment, so it is answered in the contract and its exhibits rather than in marketing copy.

The compliance framework itself is published at tetrixx.ai/legal, which is the part you should not have to ask us for.

Yes, before any data moves. All trial and calibration data is processed under signed NDA, and freight contracts and rate cards are treated as the most sensitive commercial data a shipper holds.

Yes. An MSA on client paper is acceptable and negotiated.