Terra trust center
Trust Center
Terra connects to the business systems you run your shop on. This page explains how we protect that access.
- Terra reads only the systems you connect, with the narrowest access each one allows.
- Terra changes nothing in your systems without rules you set, and those rules are checked outside the AI model.
- Your records are kept apart from every other customer’s. Our AI providers are set to keep no data and not to train on it.
Data
What Terra keeps, where it lives, who can use it and when it is deleted.
Your records are kept apart
Every record is tied to your business, and Terra refuses any request that is not. No customer can see another customer’s data.
Only the systems you connect
Terra reads only the systems you choose to connect, and only the parts you name.
Things Terra never does
Terra never takes payments, deletes records in your systems or runs payroll. It sends nothing to your customers unless you ask it to.
Sensitive details masked
Sensitive personal and financial details are masked before they are stored or read by a model.
No training on your data
Our AI providers are set to keep no data and may not train on it. Terra does not use your data to train models for other customers.
Stored in the United States
Customer data is stored in the United States, and every provider on our subprocessor list processes it there.
Deletion when you leave
When you disconnect a system, we delete the data copied from it within 30 days. When you close your account, we delete your data within 60 days, except records the law requires us to keep. Backup copies are deleted as those backups expire.
Calls recorded only with permission
Calls are recorded only with permission, and Terra says it is an AI at the start of every call.
Security
How we protect your data, your connections and the accounts that can reach them.
Encryption everywhere
Your data is encrypted when stored and when it moves between systems.
Encryption between our services
Terra’s internal services verify each other and encrypt everything they send.
Connection credentials protected
The credentials for your connected systems are encrypted, kept out of logs and destroyed when you disconnect.
Secrets kept out of code
Application secrets live in a managed vault, never in code, and each is readable only by the service that needs it.
Private network
Our database and servers are not reachable from the public internet.
Limited outside connections
Terra’s services can reach only the outside providers they need.
Two-step verification for staff
Every Terra and contractor account requires two-step verification.
Least access for staff
Staff and contractors get only the access their work needs.
Approval rules outside the AI
Before Terra changes anything in your systems, its software checks the change against rules you set. The AI model cannot skip them.
Content is never an instruction
Terra treats what it reads, like email and notes, as information. Text inside that content cannot make Terra act.
Reviewed code changes
Every change to Terra’s code is reviewed by another engineer before it ships.
Vulnerability scanning
Our code is scanned for known vulnerabilities on every change.
Risk management
How we limit what can go wrong, and what we do when something does.
Review period first
Terra starts by showing what it would do without doing it. Once you turn changes on, they need your approval for an initial period.
Pause with one text
One text from the owner pauses Terra until you resume it.
A record of every change
Every change Terra makes is logged with who approved it and when.
Backups and recovery
Our database is backed up daily and can be restored to an earlier point.
Monitoring and alerts
We monitor Terra around the clock, and alerts reach the engineer on call.
Breach notification
If we confirm an incident that affects your data, we tell you without undue delay and within 72 hours, with what we know and what we are doing about it.
Practiced incident response
We keep written steps for restoring service and practice them. After each incident we write up what happened and what we changed.
Vendor review
We review each provider’s security before it handles customer data, and sign a data agreement with each one.
Risk assessment
A yearly review of threats to Terra and your data, with an owner for each fix.
Resources
The documents behind these commitments.
Questions or a security issue?
Last updated November 4, 2026
Please do not access other customers’ data or disrupt the service while testing.