Security, Privacy, and Data Persistence

All data is hosted exclusively in EU data centres (Dublin, Ireland) within the European Union. No product data, user data, or backup data is stored outside the EU at any time. Database instances, object storage, and CDN origin servers are all located in the Ireland region. This satisfies GDPR Article 44 requirements on international data transfers by keeping all processing within the European Economic Area.

Data at rest is encrypted with AES-256, the encryption standard approved by NIST (FIPS 197) and recommended by ENISA for sensitive data protection. Data in transit uses TLS 1.3 exclusively — older protocols (TLS 1.0, 1.1, 1.2) are disabled. Database connections between application servers and the relational database use encrypted channels enforced at the connection level. File uploads in object storage use server-side encryption with provider-managed keys (AES-256).

Yes. Digital Product Passports contain product data, not personal data, so GDPR Article 6 processing restrictions do not apply to passport content. Any personal data we process — user accounts, contact details, billing information — is handled under GDPR Article 6(1)(b) (contractual necessity) and Article 6(1)(f) (legitimate interest). We offer a Data Processing Agreement compliant with GDPR Article 28 on request, maintain a public subprocessor list per Article 28(2), and support data subject rights including access (Article 15), rectification (Article 16), erasure (Article 17), and portability (Article 20).

Not yet. We are transparent about this. SOC 2 Type II audit is planned for Q4 2026 and ISO 27001 certification is targeted for 2027. Today, we implement production-grade security controls: AES-256 encryption at rest, TLS 1.3 in transit, OTP-authenticated access with no password database, immutable audit logging on all data mutations, row-level security enforced at the database layer, rate-limited APIs with abuse detection, role-based access control, automated daily backups with 30-day retention, and EU-only data hosting.

Traceable conducts application-level security testing on every release. Independent third-party penetration testing is scheduled for Q3 2026 and will be performed by a CREST-accredited provider covering OWASP Top 10 (2021 edition), API security per OWASP API Security Top 10, authentication bypass, authorisation escalation, and injection attacks. Results and remediation timelines will be available under NDA to enterprise customers upon request.

Traceable maintains a documented incident response plan aligned with NIST SP 800-61 Rev. 2 (Computer Security Incident Handling Guide). Security incidents are classified by severity (P1 through P4). P1 incidents — confirmed data breach or service compromise — trigger notification to affected customers within 72 hours as required by GDPR Article 33, immediate containment and forensic investigation, and a published post-incident report within 14 days. All incidents are logged with root cause analysis and remediation actions regardless of severity.