Security

How we keep your organisation's records safe. Write to hello@trovu.uk about anything here.

Last changed: 4 November 2026.

Where is my information kept?

In the UK. The site, its database and its email are hosted by Krystal Hosting Ltd in London. Our grants service runs on Krystal's UK servers too.

A few companies help us run Trovu, such as Stripe for payments. Our Privacy page lists them all.

Is it encrypted?

Everything between your browser and Trovu is sent over HTTPS, and browsers are told never to use anything less. Your subscription key is stored encrypted, and our backups are encrypted before they leave our servers.

Who can see my records?

• The people on your plan. Your plan's Admins choose who that is, and can take anyone off it.
• If you're a consultant: the person you name at each client charity sees your records for it, including your notes.
• If your council or CVS pays for your plan: only how you use Trovu, such as how many grants you've shortlisted and how much you've won. Never which grants or funders, and never your notes.
• Trovu's administrators, to run Trovu and to help when you ask. They sign in with a password and a code sent to their email.

Staff who only edit our web pages can't see your records.

How does signing in work?

With your email address and password. We keep passwords only in a scrambled form (bcrypt) that can't be turned back, so no one at Trovu can read yours.

After 5 wrong passwords for an account in 6 hours, or 50 from one place in an hour, signing in pauses for a while. Requests for a new password have the same limits.

The cookie that keeps you signed in is sent only over HTTPS, and scripts on a page can't read it.

How do you take payments?

Through Stripe's own payment page. Your card details go straight to Stripe and never reach Trovu. When Stripe tells us about a payment, we check the message with Stripe before acting on it.

Is there a record of who did what?

Yes, for your grants. Trovu notes who added, shortlisted, removed or restored a grant, moved it to another stage, changed its amounts or deadline, or archived it, and when. Everyone on your plan sees what others have changed since they last looked. Your plan's Admins see the whole log, and can download it as a spreadsheet or PDF. It's kept, and deleted, with your records.

Do you keep backups?

Yes, every night: the site's database, the files you upload, and our grants service's database. Each is encrypted with a key kept away from our servers, then stored with Cloudflare. If a night's backup is missing, we're told by email.

What if something goes wrong?

If personal information is lost or seen by someone who shouldn't see it, we'll tell the Information Commissioner's Office within 72 hours where the law requires it, and tell the organisations affected without undue delay.

How do I report a security problem?

Write to hello@trovu.uk and tell us what you found. Security researchers can find the same details in our security.txt file.