Data Encryption
Traceable encrypts all data both at rest and in transit using industry-standard algorithms.
Encryption at Rest
All customer data stored in the Traceable database is encrypted at rest using AES-256 encryption, managed transparently by Supabase.
| Storage layer | Encryption standard | Key management |
|---|---|---|
| PostgreSQL database | AES-256 | Supabase-managed (AWS KMS, eu-west-1 region) |
| Document storage (certificates, compliance docs) | AES-256 | Supabase Storage encryption (same KMS) |
| Database backups | AES-256 | Same key management; backups retained within the same region |
What is encrypted
Every piece of data stored in Traceable's database is encrypted at rest:
- DPP product data (all fields, all categories)
- Company and user profile information
- Supplier and material data
- Audit logs
- Document files (uploaded certificates, declarations, evidence)
- Session tokens and authentication state
What is not additionally encrypted at the application layer
Traceable does not implement a second layer of field-level application encryption on top of Supabase's storage encryption. This means Traceable engineers with database access can in principle read stored data fields. Access to the production database is restricted to a small set of named engineers and requires multi-factor authentication. All such access is logged.
Encryption in Transit
All data transmitted between any client (browser, API consumer, mobile) and the Traceable platform is encrypted using TLS 1.3.
| Connection | Protocol | Certificate |
|---|---|---|
| Browser → Vercel edge (platform) | TLS 1.3 | Automated via Vercel (Let's Encrypt / DigiCert) |
| API client → Traceable API | TLS 1.3 | Same certificate |
| Vercel edge → Supabase database | TLS 1.3 | Internal Supabase TLS |
| Platform → Resend (email) | TLS 1.3 | Resend-managed |
TLS policy:
- Minimum version: TLS 1.2 (connections using TLS 1.1 or earlier are rejected)
- Preferred version: TLS 1.3
- HSTS is enforced:
Strict-Transport-Security: max-age=63072000; includeSubDomains - HTTP → HTTPS redirect is enforced for all platform URLs
Passwords and Secrets
Traceable uses Supabase Auth for user authentication. User passwords are never stored in plaintext. Supabase uses bcrypt with an industry-standard adaptive work factor for password hashing.
API keys issued to operators are stored as SHA-256 hashes — the plaintext key is shown once at creation and never stored by the platform. If an operator loses an API key, it must be revoked and regenerated.
BMS webhook secrets follow the same model — the platform stores only SHA-256(secret). See BMS Endpoints for details.
Key Management
Traceable does not manage its own cryptographic key material for storage encryption. Encryption keys are managed by AWS KMS (Key Management Service) via Supabase's infrastructure. AWS KMS keys are:
- Stored within the
eu-west-1(Ireland) AWS region - Never exported outside that region
- Subject to automatic annual rotation
- Audited via AWS CloudTrail (Supabase side)
Further Reading
| Page | Contents |
|---|---|
| Infrastructure | Hosting providers and EU data residency |
| GDPR Implementation | Data subject rights and GDPR compliance |
| Sub-processors | Third-party services handling customer data |