Legal
Privacy policy
Truss privacy policy
Last updated 12 November 2026
Truss is a Chrome extension, with a web service and web pages at app.trytruss.com, for payroll service companies. This policy describes what the extension, its API and those pages collect today, and it is updated before any change to that.
Sending email through Gmail, described below, is available only in accounts where Truss has turned it on. Reading your company's Zoho Desk tickets, also described below, is available only in accounts where Truss has connected your company's Zoho Desk at its request.
Truss is a trade name of Payroll Automation Managers, Inc.
What we collect
Two different things, and the difference decides who controls them: information about you, and the payroll records your company keeps in the service.
About you
Your email address and your name, so an account can be identified, so the people in your company's account can see who is in it, so a run's log and its email drafts can say who did what, and so an email Truss drafts for you can be signed with your first name.
Authentication tokens we issue — a short-lived access token and a longer-lived refresh token — which identify your session to our API.
Server logs of requests to our API, including timing and outcome, and the account, run, file or sent email a request concerned. They carry identifiers, not file names, and never an email’s recipients, subject or message.
The invitation page at app.trytruss.com sets no cookies and carries no analytics or advertising code, and it loads nothing from other companies. The invitation's code sits after the # in the link, which a browser does not send when it requests the page or follows a link from it.
Your password is never sent to us. It goes to Google Identity Platform, which authenticates you and returns a token we verify once. We do not store it, and we cannot read it.
If you sign in with Google. Choosing Continue with Google opens Google's own sign-in window, and Google, not Truss, checks your Google password. Google then shares your email address and your name with Truss, and confirms that it has verified the address. We use them to create your Truss account the first time and to sign you in after that. If you sign up with Google, your Google first and last name become your name in Truss. If you already have a Truss password at the same address, your Google sign-in goes to that same account; at some addresses you are asked for your Truss password once to connect the two. Truss never sees your Google password. Signing in with Google leaves no Google token on our servers. While you finish signing up or connecting Google, the extension holds your sign-in in memory and your Google address and name in the browser’s session storage, and clears both when you finish. Sending email uses a separate permission from Google, described under Sending email from your Gmail account. Google Identity Platform, which runs sign-in for us, keeps your Google name, profile photo address and Google account id on your sign-in record. Truss does not show or use the photo.
What your company keeps in the service
Truss holds the process your company runs for each of its clients, and the record of running it:
The account's name, and the people in it: each person's name, email address and whether they are an admin. An admin chooses who joins and who is removed.
Invitations an admin sends: the email address invited, who sent it, when, when it expires, and whether it was accepted or cancelled. The person invited may not use Truss and may hold no account with us.
Client businesses, their pay cycles, and the notes attached to them, and, where Zoho Desk is connected, what Truss uses to match tickets to each client: its PRO codes, other names it goes by, and its Desk accounts.
Contacts at those clients — name, role, email address, phone number and notes. These are people who do not use Truss and hold no account with us.
The steps of each payroll run, anything added to a step — a note, a checkbox, a table, a file — and whether each is done. A table may hold employee names and hours where someone records them there.
Files a processor attaches to a run — a wage register, a timecard export, a screenshot, an email saved from Outlook — up to 50 MB each. A file can hold anything its author put in it, including employee bank details and Social Security numbers, and the correspondence of people who do not use Truss. We do not read or inspect the contents of a file attached to a run on our side.
Email drafts about a run, and every version of each: the email — its message, subject and recipients’ addresses, or their full names where no address is held — and everything used to write or change it, such as the steps chosen, what was typed to go with the request and the changes asked for, with the files listed on it. Each version records who wrote it and last changed it, when, and when it was copied or sent. A run can hold several drafts; Truss shows the newest and keeps the rest. Each time someone downloads a file from a draft’s list of files, or from a sent email, we record who, which file and when; this record is not shown in the run’s log. A file opened from a draft or a sent email opens on its preview page, and opening or downloading it there is recorded in the run’s log, like any file on the run.
Emails sent from Truss. Each email that was sent, or may have been, is kept as a record on its run, and so is a send that was cancelled, or refused once under way. The record holds:
who sent it, from which address, under what name, and when;
its To, Cc and Bcc recipients, and the contact names Truss matched to them;
its subject;
its message, as HTML and plain text, exactly as sent;
each attached file’s name, type and size;
the draft and version it came from;
Gmail’s id for the message;
whether it was sent, and why not, if it wasn’t.
A send refused before it was under way, for example because Google did not confirm the permission, stores nothing.
Anyone in your company’s account can open a sent email from the run’s log. That includes its Bcc recipients, whom the email’s own recipients do not see. The log’s entry for each send names its first To recipient, or their address if Truss holds no name for them, how many others it went to, Cc and Bcc included, and its subject. If Truss can’t tell whether an email went, the entry says it may not have sent, and a later entry corrects it if Gmail’s answer arrives. A cancelled send has no entry. A send that certainly didn’t go has none either, unless it was first shown as may not have sent. A refused send shows on its draft. Like the rest of the log, these entries stay as long as the run.
The record does not keep its own copy of the files; their contents stay attached to the run. If someone later deletes a file from the run, Truss deletes its contents on the schedule below and the sent email keeps only the file’s name, type and size. Copies in your Gmail Sent folder and in recipients’ mailboxes keep the files.
An append-only log of every change to a run: what changed, when, and which user made it. A file’s name is recorded in the log when it is attached or removed, and stays there after the file itself is deleted. The log also records each time someone opens or downloads one of the run’s files, except a download from a draft’s list of files or from a sent email, and each email sent from Truss, as described above.
Tickets from your company's Zoho Desk. Where your company has asked Truss to connect its Zoho Desk, Truss copies its tickets into the service and keeps them up to date as they change in Desk. For each ticket that the Zoho user who connected Desk can see, Truss keeps:
its number, subject, status, link, and when it was created and last changed
the contact it belongs to: their name, email address and Desk account
every message on it, emails in and out and the internal comments your team writes in Desk, with each one's sender, recipients, time and text
its history in Desk: who changed what, and when
the files attached to it, up to 32 MB each, and the text Truss reads out of them
desk's own record of each of these, as Desk returned it
its action list and every change to it: each action's text, whether it's marked done or waiting, who marked it and when, and which actions a later rewrite removed
which pay runs it has been added to, who added or removed it, when, and any reason given
Truss reads the contents of a ticket's files. It extracts their text, reading scanned pages and images with text recognition, so a ticket can be matched to a client and summarized. This runs on our own service in Google Cloud, which cannot reach the internet.
Truss also uses tickets to work out which of your clients each one is about, from the PRO codes, client names, email addresses and Desk accounts on them, and records each match. For a ticket matched to a client, Truss writes a short summary and a one-line account of each message, as described under Who else processes it.
To read Desk, Truss holds a Zoho Desk access grant your company gives it. It is kept in Google Secret Manager and used only by our server, to read tickets and to register the one notification Desk sends Truss when a ticket changes. Apart from that notification, Truss does not create, change or delete anything in your Desk.
Your employer decides what goes into these records, including which Zoho Desk is connected, and is their controller; Truss processes them on your employer’s instructions. If you are a contact or an employee named in them, ask the company that runs your payroll what is held about you — they can reach us at the address below.
Where files are kept
Files are kept in Google Cloud Storage, in the us-central1 region (Iowa, United States), in a bucket used only by Truss’s production service. A ticket's files are kept in the same storage. Your company’s other records, including the text read from a ticket's files, are in our database.
How it's Protected
Data travels between the extension, our API, and Google only over encrypted connections (HTTPS). Our database and file storage are encrypted at rest by Google Cloud, and the Gmail token is additionally encrypted with a dedicated key. Only a small number of Truss staff can access production data, and only in the cases listed under Limited Use, or, for tickets, to set up and check how your company's tickets are matched to its clients.
Sending email from your Gmail account
When an email draft about a run is ready, you can send it from Truss instead of copying it into Gmail. When Truss doesn’t yet have your permission, pressing Send first asks you to confirm the address it will send from and says it will ask Google for permission to send email from your Gmail. If you continue, Google’s own window asks you to allow it. Truss asks Google for one Gmail permission, gmail.send, and for your Google email address, so it can check that the permission belongs to the address you sign in to Truss with. Truss refuses a permission from any other Google account.
Truss uses this permission only to send an email you press Send on, once each time, from your own address. It goes to the To, Cc and Bcc recipients on the draft, appears in your Gmail Sent folder, and replies come to you. Truss never reads, lists, searches, changes or deletes the email in your mailbox, and the gmail.send permission does not let it. Once an email is sent, the version of the draft that was sent can no longer be changed.
After you press Send there is a short pause in which you can cancel: usually 5 seconds, counted from when Truss hears back from our server. It is shorter if our server is slow to schedule the send or if Truss had to retry the request. If Truss can’t reach our server to cancel, it tells you the email may still send. If you don’t cancel, the email is sent, even if you close the panel or the browser or sign out of Truss.
An email can attach files from a support ticket on the run, such as a client's scans, forms or registers, as well as files attached to the run. Truss reads them from where it keeps ticket files and passes them to Gmail only when you press Send.
The permission is a short-lived token. Each token Google gives Truss stops working within an hour. The extension keeps it in the browser’s session storage, which is held in memory and not written to disk. It never uses a token with less than five minutes left; it asks Google for a fresh one instead, usually without opening a window once you have allowed Truss. To check whether an administrator still blocks Truss, the extension may also ask Google for a fresh token without sending anything. Signing out of Truss, or Truss finding your session has ended, deletes the token from the browser. So does our server refusing it, or Gmail refusing it once the extension learns of the refusal. It is not revoked with Google, so it expires on its own.
When you press Send, the token goes to our server with the email. Our server asks Google to confirm that the token was issued to Truss, carries the send permission, belongs to your address as Google has verified it, and has at least five minutes left. It stores the token encrypted until that send is finished: normally seconds, and at most about five minutes, when our own check closes any send that hasn’t finished. If our systems fail, the token stays until we close the send, which can take longer. It is deleted when the email is sent, refused or cancelled, or when the send is closed. Database backups may still hold the encrypted token, which stops working within the hour. Truss never holds a Google refresh token. Our server can use a token only for the send it arrived with, and only while that token lasts.
To send the email, our server reads the attached files from our storage and gives Gmail the message: its sender, recipients, subject, message and files. If a file has been removed from the run by then, the email is not sent. Google tells us which app, permission and address a token is for, and Gmail tells us whether it accepted each email and, if not, why.
If your company’s Google administrator doesn’t allow Truss to send, the extension notes that for your address in this browser. While the note stands, drafts say so and offer Copy in place of Send. The note holds your address and when Google was last asked, and no token or other credential. It is checked with Google again the first time you open Truss after a day has passed, and is removed when Google next confirms that Truss is allowed. It stays after you sign out, so on a shared browser it stays until that address signs in again or the extension is removed.
How we use it
Information about you is used only to sign you in, keep you signed in, operate the service, diagnose faults, sign the emails Truss drafts for you, and send the emails you choose to send. Your company’s payroll records are used only to show them to the people in your company’s account, to let those people attach, preview and download files, to draft an email about a run when one of them asks for it, to send that email from their own Gmail account when they press Send, and, where your company has connected Zoho Desk, to copy its tickets into the service, read their files' text, match each ticket to the client it is about, and summarize it. We do not sell personal information, we do not share it with third parties for their own purposes beyond the safety and legal retention described below, we do not use it for advertising or to build profiles. We do use your information internally to improve our products and services, except information we receive from Google, which is used only as the Limited Use section below describes.
Who in your company sees it
Everyone in your company's account sees all of its records. Admins also see who is in the account, whether each person is an admin, and the invitations sent; they can invite people, remove them, make or unmake admins and rename the account.
An invitation is a link. While it works — 7 days, unless an admin cancels or renews it — anyone who opens it sees the account's name, the full name of the person who sent it, the address it was sent to and when it expires. It can be used only by someone who signs in with that address. Opening it in a browser with Truss installed stores those details in the extension on that browser until the invitation is used or no longer works.
An admin can invite any address. Inviting someone does not tell the admin whether that address already uses Truss.
Limited Use
Truss's use of information received through the Chrome extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is collected, used and transmitted only as necessary for the extension's disclosed single purpose and its operational needs, and is never transferred or sold for advertising, ad targeting, credit-worthiness or lending.
Information from Google. When you sign in with Google, Truss receives your email address and name. When you send, or when the extension checks that it still may, it receives:
a permission to send email from your Gmail account;
Google’s confirmation of which app, permission and address that permission is for, which our server checks and does not keep;
Gmail’s answer to each email sent, including its id for the message, which is kept with the sent email;
whether your company’s Google administrator blocks Truss from sending, which the extension notes in this browser.
We use this information only to provide the features this policy describes:
to sign you in;
to show colleagues in your account who did what;
to sign the drafts Truss writes;
to send the emails you ask Truss to send.
Your first name, whether it came from Google or was typed in, signs those drafts and is sent to Anthropic for that, as Who else processes it describes. If Truss holds no first name for you, the part of your email address before the @ is used instead. Your address and name appear in the From line of the emails you send.
We do not use this information for advertising. We do not sell it, and we do not use it to decide creditworthiness or for lending. We do not use it to create, train or improve AI or machine-learning models. We transfer it only to provide the features this policy describes, when you use them, for security, to comply with the law, or in a merger or acquisition with your prior consent.
People at Truss read this information only in these cases:
when you have asked us to, in writing, about specific data;
to investigate a bug or abuse, such as a send that did not finish;
for security;
to comply with the law.
The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.
Who else processes it
Google Cloud hosts the service, its database, the files attached to runs and tickets, and the service that reads a ticket's files. It also schedules each send, and each ticket update, in its task queues; its key service encrypts the token we store with a pending send, and Secret Manager holds your company's Zoho Desk access grant.
Google Identity Platform authenticates sign-in, with a password or with Google, and sends account email such as password resets.
Zoho runs your company's Zoho Desk. Truss reads tickets from it with your company's grant, and Desk notifies Truss when a ticket changes. Your company's use of Desk is under its agreement with Zoho.
Anthropic writes a draft email about a run when you ask for one, and changes it when you ask for a change. We send it the steps you chose and what is recorded in them, which can include employee names and hours; the names and types of the files on those steps, and of any other file you add to the draft; the cycle’s notes, the pay period and pay dates; the client’s name and the run’s status; your first name, to sign the email (or, if we hold none, the part of your email address before the @); anything you type to go with the request; and, for each contact involved, their first name, their role, the line describing their part in the step and the notes kept about them. When you ask for a change, we also send the draft as it stands: its subject, its message and its message before the last change, the changes asked for before, and its recipients as they appear in its To line — a contact on the run by first name, and any other recipient as written there, which can be an email address or a full name. A file’s name can include an employee’s name. We never send a file’s contents. Otherwise we do not send a contact’s surname, email address or phone number. When a step you pick for a draft is a support ticket, Truss also sends Anthropic that ticket's summary title and one-line summary, its list of actions and whether each is done or waiting, one written line per message on the ticket with its sender, its time and whether it came from your client, from your team or is an internal note, and the names and types of the ticket's files. It never sends a message's or a file's own text. Internal notes are sent as context and Anthropic is instructed never to repeat them, but a draft could, so read each draft before you send it.
For each ticket matched to one of your clients, Anthropic also writes its summary and list of work the ticket asks of your team, and writes it again each time the ticket changes. To write that list, Anthropic also gets the actions already on it and which ones your team has marked done or waiting, so it keeps them as they are. We send it the ticket's subject and status; each message's text, without the earlier messages it quotes; each message's sender (their name, or their email address where Desk gives no name), direction, whether it was an internal comment, and time; the names and types of the ticket's files and up to 20,000 characters of text from each, and 60,000 in all; and the names of the clients the ticket is matched to. We send nothing for a ticket matched to no client, and never Desk's own record of a ticket.
Each processes data only on our instructions. For your company’s records, which we process for your employer, they are our sub-processors. Anthropic uses sub-processors of its own, listed at anthropic.com/subprocessors. We add no others without updating this policy.
Anthropic’s commercial terms do not allow it to train models on what we send it or what it returns. The only exceptions Anthropic names are feedback or bug reports a customer sends it and a customer’s agreement to allow training. Truss sends it no feedback, and we have not agreed to training.
Anthropic deletes what we send and what it returns within 30 days. It may keep a request longer where needed to enforce its usage policy — up to two years if its safety systems flag it, and flagged requests may be reviewed by its staff — or where the law requires it. Gmail is not one of these processors. When you send an email from Truss, Google’s Gmail sends it from your own Google account, under your agreement with Google rather than ours, and keeps it in your Sent folder.
How long we keep it
Account records and your company’s payroll records are kept while the account exists. A run’s log is append-only for as long as the run is kept, because it is the record of who did what.
Invitations are kept while the account exists, including those that were accepted, cancelled or expired. An expired invitation stops working but is not deleted.
When an admin removes someone, they are signed out at once and can no longer sign in to that account. Their name and email address stay in the account's records, so its log, drafts and history still say who did what, and an admin no longer sees them in the list of people. Their address is free to join or create another account.
A file attached to a run is kept until someone removes it, or removes the step that holds it. After that, a deleted file is unreachable at once, is deleted from our storage 7 days later, and is removed from Google’s systems, backups included, within Google Cloud’s deletion commitment of about 180 days. The 7 days are a holding period in Cloud Storage: during them we cannot purge the file early, and nobody can reach it through Truss. If deleting a file fails, we are alerted and deal with it. A file uploaded but never attached to a run may remain in storage; when we remove it, the same schedule applies.
Email drafts, every version of them and the record of their downloads are kept while the account exists. Nothing in Truss deletes a draft or a version, including earlier drafts and versions that no screen shows any more. A request to delete data, under Your choices below, covers drafts too, and we carry it out ourselves. A draft and its versions can list files from support tickets on the run, as well as the run's own files.
Sent emails, including the record of sends that were cancelled or refused, are kept while the account exists, as drafts are. Like the rest of your company’s records, they are deleted on your employer’s instruction. The token that lets Truss send is deleted from our server when its send finishes, as described under Sending email from your Gmail account. A copy of an email in your Gmail Sent folder, or in its recipients’ mailboxes, is not Truss’s to delete.
Tickets, with their messages, files, the text read from them, their summaries, action lists and the runs they were added to, are kept while the account exists. Deleting a client deletes the record of which runs its tickets were on. A ticket, message or file deleted in Desk is hidden in Truss and not deleted from it; a ticket deleted in Desk for 90 days is no longer checked for changes. A file over 32 MB is recorded by name and size, and its contents are not copied. Pausing the connection to Desk stops new tickets arriving and keeps those already copied. A request to delete data, under Your choices, covers tickets too, and we carry it out ourselves.
Session and refresh token records are kept until they expire or are revoked, and signing out revokes them immediately.
Your choices
You can sign out at any time, which ends the session on our side as well as in the browser. To ask what we hold about you, to correct it, or to have your account and its data deleted, write to privacy@trytruss.com. We answer within 30 days. Files we delete at your request follow the schedule above: unreachable within 30 days, deleted from our storage 7 days later, and removed from Google’s systems within about 180 days. What was sent to Anthropic for a draft or a ticket summary cannot be deleted early; it expires on Anthropic’s schedule above.
You can take back Truss’s permission to send at any time on your Google Account’s Linked apps page (myaccount.google.com/linkedapps): choose Truss (it may be listed under “Truss has some access to your Google Account”), then See details, Remove access and Confirm. Truss then cannot send from that account until you allow it again at your next Send. If you sign in to Truss with Google, Google may also ask you again to allow that sign-in.
Changes
Truss reads tickets from Zoho Desk, as described above, where a company asks for it. Before Truss reads payroll data from any other system, this policy is updated to describe it — what is read, why, and how long it is kept.
Contact
Truss — privacy@trytruss.com
