Infrastructure & Data Residency
All Traceable platform infrastructure is hosted within the European Union, with one narrow, opt-in exception: when an operator explicitly enables Document AI, uploaded document content is transferred to Anthropic, Inc. (United States) for AI extraction under EU Standard Contractual Clauses (GDPR Art. 46). All other customer data is processed and stored on EU infrastructure. See Sub-processors.
Hosting Architecture
| Component | Provider | Region | Location |
|---|---|---|---|
| Application hosting (edge/CDN) | Vercel | EU | Frankfurt, Germany (fra1) |
| Database (PostgreSQL) | Supabase | EU | Dublin, Ireland (dub1) |
| Rate limiting | Upstash Redis | EU | EU West (Amsterdam/Frankfurt) |
| Transactional email | Resend | EU | EU region |
| Error monitoring | Sentry | EU | EU region |
The core platform data path — database, object storage, compute, transactional email, and error monitoring — is hosted entirely within the EU. The only processing outside the EU is the optional Document AI feature: when an operator explicitly opts in, uploaded document content is transferred to Anthropic (US) under EU Standard Contractual Clauses (GDPR Art. 46) for extraction. See Sub-processors.
Vercel (Application Layer)
Traceable's application and API run on Vercel's serverless infrastructure. The Vercel project is configured to use the EU (Frankfurt) region as the primary function execution region.
What runs on Vercel:
- All web application routes (operator portal, supplier portal, verifier portal, public DPP viewer)
- All API endpoints (
/api/*) - Middleware for authentication, rate limiting, and request routing
Vercel's GDPR posture: Vercel maintains EU Standard Contractual Clauses (SCCs) with customers. Their EU infrastructure does not transfer data to US infrastructure for processing. See Vercel's Privacy & Security documentation for their full disclosure.
Supabase (Database Layer)
Traceable uses Supabase (dub1 — Dublin, Ireland) for all persistent data storage:
- PostgreSQL database for all application data (companies, products, DPP records, users, audit logs)
- Supabase Auth for authentication token management
- Supabase Storage for document uploads (certificates, compliance documents)
- Row-Level Security (RLS) is enabled on all tables — each company's data is isolated by policy-enforced row-level security at the database layer (RLS is an authorization control, not encryption)
Supabase's GDPR posture: Supabase operates its EU infrastructure within EU jurisdiction and maintains SCCs. The dub1 region is hosted on AWS eu-west-1 (Ireland), a region that has not been subject to transatlantic data transfer restrictions under EU law.
Data Residency Guarantee
Traceable guarantees that:
- Customer data is processed and stored in the EU, with one opt-in exception: when an operator enables Document AI, the document content submitted for extraction is transferred to Anthropic (US) under EU Standard Contractual Clauses. All other processing, storage, and transmission of DPP and personal data occurs on EU infrastructure.
- Sub-processors are EU-resident — every third-party service that handles customer data operates from EU infrastructure (see Sub-processors).
- Backups are retained in the same region — Supabase database backups remain within the
dub1region. - No third-country transfers — Traceable does not transfer customer data to any jurisdiction outside the EU without explicit operator consent and appropriate safeguards.
Network Security
| Control | Implementation |
|---|---|
| Transport encryption | TLS 1.3 on all connections; TLS 1.2 minimum; older versions rejected |
| Certificate management | Automated via Vercel (Let's Encrypt / DigiCert) |
| HSTS | Strict-Transport-Security: max-age=63072000; includeSubDomains |
| API authentication | Bearer token required for all write endpoints; read-only public endpoints rate-limited per IP |
| Rate limiting | Upstash Redis sliding-window rate limiter on all API endpoints (see Rate Limiting) |
| DDoS protection | Vercel edge network |
Availability
Traceable targets 99.9% monthly uptime for the platform API and operator portal. Supabase's dub1 region SLA is 99.9%. Planned maintenance is communicated via the changelog and, where applicable, advance notice to operators.
The health endpoint at GET /api/health provides a real-time service status check suitable for uptime monitoring integrations.
Further Reading
| Page | Contents |
|---|---|
| Data Encryption | Encryption at rest and in transit |
| GDPR Implementation | How Traceable implements data subject rights |
| Sub-processors | Full list of third-party data processors |
| Vulnerability Disclosure | How to report security issues |