One binary, one database
The web app, the API and the worker are one executable, coordinating through one Postgres database. There is no message broker and no internal service to secure.
Security & trust
Your data never reaches us, because there is nowhere for it to go.
Trinium runs as containers inside your network, beside a Postgres database you own. We run no service on your behalf, receive no telemetry, and cannot see what you run.
Architecture
A small attack surface, on purpose.
Everything below the dashed line is yours. Above it there is exactly one thing, and all it does is serve container images.
Your network
Your peopleA browser. Nothing installed.
Your reverse proxyOptional. Trinium terminates TLS itself if you would rather it did.
Trinium, one binary
API, web UI and the queue worker in a single process
API + UI
Worker
Scheduler
HTTP
Python runner
Enterprise only, and deliberately starved
no database handle
no encryption key
no egress
read-only rootfs
PostgreSQLThe only bus: queue, run progress, telemetry, logs and cancellation all flow
through tables
Your data
Reached outbound, only when one of your pipelines asks for it
databases
warehouses
object storage
SFTP
SaaS APIs
Container registryThe only path out, and it only pulls images
- No telemetry
- No licence server
- No phone-home
- No hosted control plane
Runs as an unprivileged user
The container runs without root, the application itself is read-only, and it writes only to the folders you mount.
One image for every edition
Pro and Enterprise are the same image. Your licence key decides what is switched on, so there is no special build to trust.
Controls
Every control a security review asks about.
Protecting data
Credentials, encrypted with your key
Encrypted the moment they are saved, with a key Trinium generates on your server, and never shown again. Pipelines hold only a connection’s name, and a password typed into one is flagged.
ChaCha20-Poly1305
HTTPS, built in
Drop a certificate and key into a folder and Trinium serves HTTPS itself, picking up renewals without a restart.
TLS 1.2 · 1.3
TLS to every database
Each connection has an SSL mode you set, up to full certificate verification. Managed cloud databases verify with nothing to configure.
Signing in
Single sign-on, or your directory
Okta, Entra ID, Google and other OIDC providers, or LDAP and Active Directory, with your provider’s multi-factor sign-in. You choose whether a first sign-in creates an account.
OIDC + PKCELDAP
Passwords, only if you want them
Local passwords are hashed with Argon2 and can be switched off, leaving one emergency admin account whose password only you hold.
Argon2
Sessions and offboarding
Sessions end after four hours idle. A deactivated account cannot sign in, and anyone already signed in is out within fifteen minutes.
Access
Eight roles, and private work
From User to Super Admin, including a read-only Auditor. Pipelines stay private to their owner or workspace, even from administrators.
Connections carry their own access list
Share a connection with everyone, a workspace or one person, with an optional expiry. Revoking takes effect at once, and sharing a pipeline never shares its connections.
Production is a separate permission
Using a connection in staging never grants production. That permission is off by default, and nobody holds it implicitly, administrators included.
The platform
Custom code in a sandbox
Python runs in its own container on a read-only filesystem, with no network, no database access and no encryption key.
Backups you control
Encrypted with your key, or made portable without credentials. Lose the key and you lose saved passwords, never your pipelines.
A sign-in that gives nothing away
A failed sign-in reads the same whether or not the account exists. The exact reason goes to the audit trail, where only auditors can read it.
Audit
Who changed what, and when.
Self-hosting usually costs you auditability. Here it doesn’t.
WhenWhoActionObjectOutcomeDetail
14:02:11a.morenouserRole changedj.leeSuccessrole
Actor typeUser
Kinduser
Changerole Analyst Engineer
14:05:47j.leepipelinePromotednightly-ordersDeniedYou don’t have Production access to the “Warehouse” connection
14:06:03r.kimloginFailed Failurewrong password
- Every change, every refusal. Sign-ins, settings, access, pipelines, runs, downloads and backups are recorded, including the attempts that were refused and why.
- Before and after, never a secret. Each change records the old and new value. A password is recorded only as changed, and a pipeline edit as “added Filter”.
- Cannot be edited or lost. The database refuses edits and nothing deletes an entry. Entries outlive the accounts they name and survive a restore, and a build check keeps every new feature recording itself.
- Straight into your SIEM. Every entry is also written to the server log as it happens, ready for your log collector. The trail filters by person, object, outcome and date, and exports as CSV.
Have a questionnaire to fill in?
Send it over. We would rather answer it plainly and early than discover a blocker in procurement.