What we promise, and where it stops.
Trina Drive does not try to make an AI agent trustworthy. It limits what any one agent connection can reach, keeps originals out of its reach, and records what it read. These are the promises, and the limits that come with them.
Five guarantees
-
Through Trina Drive, nobody writes to originals — admins included.
The only write path is the draft box. Promoting a draft creates a new file and never overwrites one.
-
An agent never sees more than its person.
Agent view = the person’s AI rules ∩ the token’s scope, decided in one function that the shell, file tools, search and web downloads all call.
-
A hidden folder looks exactly like a missing one.
Same output, same error, same exit code — so names outside an agent’s view don’t leak.
-
A newly registered folder is visible to no AI.
Every registered folder starts at “nobody” until you choose whose AI may read it.
-
A rewritten audit log gets caught.
Every call lands in a hash chain; its signed head is sent off the server, and tdrive audit verify checks the history against it.
Storage, permission decisions and the logs are on your server. What an agent reads goes to the AI company that made that agent (Anthropic, OpenAI and others).
Mark folders where that must not happen as “No AI”. Personal folders cannot be read secretly, not even by admins (unregistering one or changing its owner notifies the owner), but whoever runs the server — for managed plans, our operators — can see the disk.
Known limits
We publish these so you can decide with the full picture. The complete, technical list is in the security model.
- What an agent reads goes to the AI provider its person chose. Mark folders where that must not happen as “No AI”.
- Guarantees cover access through Trina Drive only. A laptop that mounts the NAS directly goes around it; for people who use AI, connect through Trina Drive instead of a mount.
- It does not stop prompt injection. It narrows what an agent can reach, labels drafts with their sources, alerts on bulk reads and logs every call.
- Copies made through an agent’s memory or local files, or moved to shares you have not registered, are not caught.
- NAS permissions are not read automatically, so the NAS and the AI rules can disagree. Sub-folder permissions set on the NAS are not known.
- Small gaps remain: timing differences between hidden and missing paths are not equalised, and a folder is re-checked around a write rather than atomically with it.
- On managed plans, our operators can see the server’s disk.
Self-hosted and managed
Self-hosted
You run the software on your own Mac mini or Linux box. Storage, permission decisions and logs stay on your server, and we have no access.
Managed
The same software, operated by us on your office Mac mini: install, monitoring, updates, backups and hardening. Our operators can see the server’s disk.
Review and disclosure
External review
An external security review is part of our release gate and is in progress. When it is done we will publish who reviewed it and what was in scope.
Report a vulnerability
Email security@trina.app rather than opening a public issue. We reply within 72 hours.
Fixes for everyone at once
Security fixes are released to every installation at the same time, self-hosted and managed alike.