Security, Privacy, and Data Persistence

Customer data is stored in the European Union. The database, file storage and application run in Ireland. AI features run on Anthropic's Claude models through Amazon Bedrock in the European Union. AWS states in its Amazon Bedrock FAQ that neither AWS nor third-party model providers use inputs to or outputs from Amazon Bedrock to train models, and that inputs and outputs are not shared with model providers. AWS also states in its Amazon Bedrock User Guide that model providers do not have access to Amazon Bedrock logs or to customer prompts and completions. Transfers to non-EEA subprocessors are covered by the safeguards required under Chapter V of the GDPR, and every subprocessor, its location and its transfer mechanism are published on our Subprocessors page.

Data at rest is encrypted with AES-256, the encryption standard approved by NIST (FIPS 197) and recommended by ENISA for sensitive data protection. The platform is served only over HTTPS, and browsers are instructed to use HTTPS for future visits. File uploads in object storage use server-side encryption with provider-managed keys (AES-256).

To support your account, a small number of identified Traceable staff can open your account and view most of it, read-only, with a Viewer's permissions, without asking you first. Every time this happens, your account administrators are sent an email and an in-app notice, and the session, including the pages viewed, is recorded in your own audit trail for you to review. During these sessions, staff cannot add, change, or delete anything in your account, and some areas, such as billing and API credentials, stay off-limits. Each session is capped at 60 minutes, and the staff member must record a reason you can see.

Yes. Any personal data we process (user accounts, contact details, billing information) is handled under GDPR Article 6(1)(b) (contractual necessity) and Article 6(1)(f) (legitimate interest). We publish a Data Processing Agreement under GDPR Article 28 at traceable.digital/legal/data-processing-agreement/, maintain a public subprocessor list per Article 28(2), and support data subject rights including access (Article 15), rectification (Article 16), erasure (Article 17), and portability (Article 20).

Not yet. We are transparent about this. We are implementing an information security programme against the ISO/IEC 27001:2022 control set. We are not certified, and certification by an accredited body is planned. Today, our security controls include AES-256 encryption at rest, TLS in transit, rate-limited APIs, role-based access control and automated daily backups. Passwords are verified by a managed authentication provider. Security-relevant actions are recorded in an audit trail, and the records are linked by a hash chain. The platform separates each customer's data from other customers' data in the application. Row-level security is enabled on database tables as a further control on direct database access.

Unit, contract and end-to-end tests guard the platform's behaviour. The unit and contract suite must pass before a change is merged. A high or critical vulnerability in a production dependency fails the required automated check. Independent third-party penetration testing is planned for Q2 2027.

Traceable maintains a documented incident response plan. Security incidents are classified by severity from P0 (Critical) to P3 (Low), with initial response targets of 60 minutes for P0, 90 minutes for P1, 6 hours for P2 and 12 hours for P3. P0 targets apply at all times, including nights, weekends and public holidays. P1, P2 and P3 targets are measured in business hours: Monday to Friday, 09:00 to 18:00 Central European Time, excluding public holidays. Traceable notifies the affected customer without undue delay after becoming aware of a personal data breach (GDPR Article 33(2)). A blameless post-incident review is carried out promptly after resolution. Anyone who suspects a security incident reports it immediately to security@traceable.digital.