Data Encryption
The platform is served only over HTTPS, and browsers are instructed to use HTTPS for future visits. Customer data in the managed database and file storage is encrypted at rest by the provider.
Encryption at Rest
All customer data stored in the Traceable database is encrypted at rest using AES-256 encryption, managed transparently by Supabase.
| Storage layer | Encryption standard | Key management |
|---|---|---|
| PostgreSQL database | AES-256 | Supabase-managed |
| Document storage (certificates, compliance docs) | AES-256 | Supabase Storage encryption (provider-managed) |
| Database backups | AES-256 | Uploaded-file backups are stored in Ireland. Database backups are managed by the database provider. |
What is encrypted
Every piece of data stored in Traceable's database is encrypted at rest:
- DPP product data (all fields, all categories)
- Company and user profile information
- Supplier and material data
- Audit logs
- Document files (uploaded certificates, declarations, evidence)
- Session tokens and authentication state
What is not additionally encrypted at the application layer
Traceable does not implement a second layer of field-level application encryption on top of Supabase's storage encryption. This means Traceable engineers with database access can in principle read stored data fields. Access to the production database is restricted to named administrators, and the database provider organisation requires multi-factor authentication.
Encryption in Transit
All data transmitted between any client (browser, API consumer, mobile) and the Traceable platform is encrypted using TLS.
| Connection | Protocol | Certificate |
|---|---|---|
| Browser → Vercel edge (platform) | TLS | Automated via Vercel (Let's Encrypt / DigiCert) |
| API client → Traceable API | TLS | Same certificate |
| Platform → Resend (email) | TLS | Resend-managed |
TLS policy:
- Minimum version: TLS 1.2 (connections using TLS 1.1 or earlier are rejected)
- Preferred version: TLS 1.3
- HSTS is enforced:
Strict-Transport-Security: max-age=63072000; includeSubDomains; preloadon Traceable platform hosts (customer custom domains usemax-age=31536000) - HTTP → HTTPS redirect is enforced for all platform URLs
Passwords and Secrets
Traceable uses Supabase Auth for user authentication. User passwords are never stored in plaintext. Supabase uses bcrypt with an industry-standard adaptive work factor for password hashing.
API keys issued to operators are stored as SHA-256 hashes — the plaintext key is shown once at creation and never stored by the platform. If an operator loses an API key, it must be revoked and regenerated.
BMS webhook secrets are shown once at creation. The platform keeps a SHA-256 hash of each secret and also stores the secret itself in Supabase Vault, the database provider's secrets store, so that signed requests can be verified. See BMS Endpoints for details.
Key Management
Traceable does not manage its own cryptographic key material for storage encryption. Encryption keys are managed by the database provider.
Further Reading
| Page | Contents |
|---|---|
| Infrastructure | Hosting providers and EU data residency |
| GDPR Implementation | Data subject rights and GDPR compliance |
| Sub-processors | Third-party services handling customer data |