trio.so

GDPR compliance for every device that holds personal data

Customer records, emails and exports live on the laptops and phones your staff carry. trio.so encrypts and locks down every device, checks that the settings stay on, and keeps the record you need under Article 32. It covers Windows, macOS, Linux, iOS/iPadOS and Android. Consent and data subject requests stay with your privacy tools.

Start free trialBook a demo
  • Regional Leader, EMEA, Spring 2025
  • Easiest To Do Business With, Mid-Market, Spring 2025
  • Momentum Leader, Spring 2025
  • High Performer, Middle East, Spring 2025
  • Best Support, Mid-Market, Spring 2025

Rated 4.8 on G2

Endpoint compliance  ›  Frameworks  ›  GDPR (security)
  • Disk encryption is enabledCTL-ENC-01Art. 32(1)(a)
    critical0 devices
  • Passcode is requiredCTL-PWD-01Art. 32(1)(b)
    high3 devices
  • Screen locks after 5 minutesCTL-LCK-01Art. 32(1)(b)
    low6 devices
  • OS version meets minimumCTL-PAT-01Art. 32(1)(b)
    medium5 devices
  • Removable storage is blockedCTL-USB-01Art. 32(1)(b)
    medium2 devices
Configuration policyDisk encryption · Windows · macOS · Linux
Resolved
Resolved after next evaluation
Audit trail

09:42Trio · Finding resolved · Disk encryption is enabled (Art. 32(1)(a)) · open → resolved after next evaluation · 4 devices

  • Diyar Private Academy
  • Wires & Fabriks
  • Corvuss American Academy
  • Arabi Company W.L.L.
  • Loglass
  • Skill Authority
  • Bright Learners
  • Synonym
  • Trell

The risk

Personal data travels on every work device

Most personal data breaches don't need a hacker. A laptop left on a train or an unpatched phone is enough. GDPR expects security that fits the risk, and that includes the devices your team uses.

  • Devices get lostA lost laptop with customer data on it can become a reportable breach.
  • The clock is shortArticle 33 gives you 72 hours to tell your supervisory authority after you become aware of a breach.
  • Encryption changes the outcomeUnder Article 34(3)(a), you may not need to tell each affected person if the data was unintelligible to others, for example encrypted.
  • Regular testingArticle 32(1)(d) asks you to test and evaluate your security measures regularly.
A lost device locked and wiped remotely

How it works

How GDPR device checks work in trio.so

trio.so automates the device checks behind Article 32. Turn on the GDPR security framework, see which devices fail which controls, and fix the settings with policies from the same console. The checks repeat on the schedule you set, so regular testing becomes a record instead of a yearly task.

  1. Turn on GDPRActivate the GDPR security framework. trio.so maps its device checks to the points of Article 32.
  2. See what's exposedFindings show which devices miss encryption, a screen lock or updates, ranked by severity.
  3. Fix and confirmFix the setting with a policy. A finding closes only after the next evaluation passes on that device.
Start free trialBook a demo

Article 32

What GDPR Article 32 asks of your devices

Most of GDPR is about why and how you use personal data. Article 32 is about keeping it safe, and devices are a large part of that. Here is what trio.so does for each point, and where the proof lives.

GDPR articleHow trio.so helpsEvidence in trio.so
32(1)(a)Encryption of personal data

Turns on BitLocker, FileVault and Linux disk encryption, and enforces encryption on phones and tablets.

Encryption status for each device.

32(1)(b)Ongoing confidentiality

Screen lock, passcode rules, USB storage blocking on Windows and Linux, and WPA2 or WPA3 Wi-Fi, set as policies.

Policy status: applied, failed or pending, device by device.

32(1)(b)Integrity and resilience

Ranks vulnerabilities by CVSS, EPSS and the KEV list, and patches the OS and third party apps on your schedule.

Patch history: each job, the devices it reached and the result.

32(1)(d)Regular testing of measures

Evaluates every control on every device on a schedule, not once a year.

Findings and evidence records, each with its time and freshness.

5(1)(f)Protection against unauthorized processing

Checks that anti-malware is running on each computer, and shows Microsoft Defender for Endpoint alerts per device.

Check results for each device, with Defender alerts beside them.

32(2)Risk of loss

Locks or wipes a lost device from the console, and shows who owned it and what was installed.

A device list with owner, serial number and apps, exportable as CSV.

Article numbers from Regulation (EU) 2016/679. trio.so supports the device side of Article 32; it is not a privacy program.

Controls

Protect personal data on every device

Set each safeguard once. trio.so sends it to every enrolled device, and each device reports whether it applied, failed or is still pending.

  • EncryptionEvery disk and every phone, so a lost device doesn't expose its data.
  • AccessScreen lock, passcode length and lockout after failed attempts.
  • UpdatesOS and third party apps patched on a schedule you set.
  • Lost devicesLock or wipe from the console when a device goes missing.

Remediation

Track fixes and log every step

When a device falls out of line, you fix the setting with a policy, the next check confirms it, and the record stays in the same place. That record is what you show when someone asks how you protect personal data.

  • Fixes through policiesA configuration policy turns on encryption or sets the screen lock on the failing devices, and each device reports applied, pending or failed.
  • Proven, not assumedThe finding closes only after the next evaluation passes.
  • Exceptions with an end dateAn exception covers one control on one device and expires, then the check applies again.
  • A clear trailEvery policy change, evaluation and resolved finding, with who, when and what changed.
A laptop failing a check, the setting fixed, and the laptop passing on the next check

See your GDPR device findings in a free trial

Enroll a few devices, turn on the GDPR security framework, and see which devices would expose personal data today.

Start free trialBook a demo
5
platforms, Linux included
$5
Plans start at $5 per device.
14 days
free trial, no credit card
24/5
support from our team
Monday to Friday

Every OS

GDPR checks on every platform

Personal data sits on every kind of device. Here is what trio.so checks on each, so you know what your Article 32 record covers.

  • Windows
  • macOS

Windows and macOS

Disk encryption, screen lock, firewall, OS updates and anti-malware, plus the status of every policy.

  • Linux

Linux

Disk encryption, firewall and OS update signals, USB storage blocking, and the status of core policies.

  • iOS/iPadOS
  • Android

Phones and tablets

Passcode and encryption on every phone and tablet, remote lock and wipe, and Android work profiles that keep work data apart on personal phones.

Evidence

A record of how you protect personal data

When a regulator, an auditor or a customer asks how personal data is protected on your devices, you can show it: which controls run, on which devices, and when they last passed.

  • Encryption statusEvery computer, phone and tablet, current at the last check.
  • Findings by Article 32 pointWhich devices pass and fail each control.
  • Evidence recordsEach check result with its source, time and freshness.
  • Audit trailWho changed what, from activation to closed findings.
  • Device listOwner, serial number, OS and apps for every device, exportable as CSV.

Why trio.so

Device security and its record in one console

Privacy teams usually get device security as a screenshot from IT. With trio.so, the console that manages the devices also checks them and keeps the evidence.

  • One record per device

    Encryption, policies, patches, inventory and remote actions together.

  • Pricing you can read

    Plans start at $5 per device. Endpoint compliance is in the Secure plan and above.

  • Rated 4.8 on G2

    With support from real people 24 hours a day, Monday to Friday.

Related

Related compliance features

Integrations

Works with the tools you already use

Keep device evidence current in Vanta, see Microsoft Defender for Endpoint alerts per device, stream events to Splunk, alert your team in Slack or Microsoft Teams, and sync users from Microsoft Entra ID or Okta.

  • Vanta
  • Microsoft Defender
  • Splunk
  • Slack
  • Microsoft Teams
  • Microsoft Entra ID
  • Okta

GDPR FAQ

No. trio.so covers the device security measures under Article 32 and keeps the evidence for them. Your lawful bases, consent, records of processing, impact assessments, data subject requests and processor contracts stay with you, your privacy tools and your DPO. Our GDPR compliance checklist covers the full list.

Article 32 asks for security that fits the risk, including encryption, ongoing confidentiality and integrity, and regular testing of your measures. Article 5(1)(f) sets the same principle: protect personal data against unauthorized use, loss and damage. For devices, that means encryption, access control, updates and checks that prove they work.

Lock or wipe it from trio.so, and check its last known encryption status and owner. If it counts as a breach, Article 33 gives you 72 hours to tell your supervisory authority. If the data was encrypted, Article 34(3)(a) may mean you don't have to tell each affected person.

They do when they hold personal data you are responsible for. trio.so can manage personal Android phones through a work profile, which keeps work apps and data apart from personal ones.

Yes. The UK GDPR keeps the same Article 32 wording, so the same device controls and the same evidence apply.

It depends on the job. Consent, cookies, data mapping and data subject requests need a privacy management tool. The security of the devices that hold the data needs device management with checks and evidence, which is where trio.so fits. Many teams use both, and trio.so can send its device data to Vanta.