Infrastructure & Data Residency
Customer data is stored within the European Union. AI features run on Anthropic's Claude models through Amazon Bedrock in the European Union. Neither AWS nor Anthropic uses inputs or outputs to train models, and Anthropic has no access to them. This describes where data is stored; it does not describe who can access it. Traceable Digital Private Limited is established in India, and personnel located there access this data, under the Standard Contractual Clauses in Traceable's Data Processing Agreement, to operate and support the Platform. See the Subprocessors page for each provider's location and transfer mechanism.
Hosting Architecture
| Component | Provider | Region | Location |
|---|---|---|---|
| Application hosting | Vercel | EU | Dublin, Ireland (dub1); requests pass through Vercel's global edge network, and only content that is the same for every visitor, such as static files, the sign-in page and public passport pages, is cached at the edge |
| Database (PostgreSQL) | Supabase | EU | Ireland (AWS eu-west-1) |
| Rate limiting | Upstash Redis | EU | Ireland (AWS eu-west-1) |
| Transactional email | Resend | EU sending, US records | Sent from Ireland (eu-west-1); email records stored in the United States, covered by Standard Contractual Clauses and the EU-U.S. Data Privacy Framework |
| Error monitoring | Sentry | EU | Germany (Sentry EU, de.sentry.io) |
| AI processing | Amazon Web Services (Amazon Bedrock) | EU | European Union |
| Backup copies of uploaded files | Amazon Web Services | EU | Ireland |
The core platform data path (database, object storage, compute and error monitoring) is hosted within the EU. Transactional email is sent through Resend from Ireland; Resend keeps its records of each email in the United States, under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. AI features run on Anthropic's Claude models through Amazon Bedrock in the European Union. Neither AWS nor Anthropic uses inputs or outputs to train models, and Anthropic has no access to them. This is a statement about infrastructure location, not about personnel access: Traceable's own personnel in India access this data to operate and support the Platform, as set out at the top of this page. See the Subprocessors page.
Vercel (Application Layer)
Traceable's application and API run on Vercel's serverless infrastructure. The Vercel project is configured to use the EU (Dublin) region, dub1, as the primary function execution region, keeping compute in the same EU country and AWS region (eu-west-1) as the database.
What runs on Vercel:
- All web application routes (operator portal, supplier portal, verifier portal, public DPP viewer)
- All API endpoints (
/api/*) - Middleware for authentication, rate limiting, and request routing
Vercel's GDPR posture: Vercel's Data Processing Addendum incorporates the EU Standard Contractual Clauses, and Vercel is certified under the EU-U.S. Data Privacy Framework. Traceable's platform runs only in Vercel's Dublin region; requests pass through Vercel's global edge network on their way there, and only content that is the same for every visitor is cached at the edge: static files, pre-built pages such as the sign-in page, and public passport pages. Customer data that is not public is not cached at the edge. Traceable's own personnel, based in India, access data through the application layer under Traceable's Data Processing Agreement (see the note above). See Vercel's Privacy & Security documentation for their full disclosure.
Supabase (Database Layer)
Traceable uses Supabase (AWS eu-west-1, Ireland) for all persistent data storage:
- PostgreSQL database for all application data (companies, products, DPP records, users, audit logs)
- Supabase Auth for authentication token management
- Supabase Storage for document uploads (certificates, compliance documents)
- The platform separates each customer's data from other customers' data in the application. Row-level security is enabled on database tables as a further control on direct database access.
Supabase's GDPR posture: Supabase's Data Processing Addendum incorporates the EU Standard Contractual Clauses. Traceable's Supabase projects are hosted in AWS eu-west-1 (Ireland).
Data Residency Commitments
Traceable's data residency practices:
- Customer data is stored in the EU. AI features run on Anthropic's Claude models through Amazon Bedrock in the European Union. Neither AWS nor Anthropic uses inputs or outputs to train models, and Anthropic has no access to them. Traceable's own personnel in India access this EU-hosted data to operate and support the Platform, under the Standard Contractual Clauses in Traceable's Data Processing Agreement.
- Email records are kept in the United States. Resend sends email from Ireland (eu-west-1) but keeps its records of each email, including email metadata, logs and API records, in the United States. This is covered by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. Vercel runs the platform only in its Dublin region (dub1). Requests pass through Vercel's global edge network on their way there, and only content that is the same for every visitor is cached at the edge: static files, pre-built pages such as the sign-in page, and public passport pages. Customer data that is not public is not cached at the edge. The platform is not routed through Cloudflare, which only answers DNS lookups for it; Cloudflare also protects the public website and docs site. Details for every provider are on the Subprocessors page.
- Uploaded files are backed up in the EU. Copies of uploaded files are backed up nightly to Amazon S3 in Ireland (eu-west-1).
- Cross-border access is safeguarded, not eliminated. Access to customer data from outside the EU, including by Traceable's own team in India and by sub-processors, relies on the European Commission's Standard Contractual Clauses (Decision 2021/914) or, where the recipient is certified, the EU-U.S. Data Privacy Framework. The legal basis for this is the contractual safeguard, not operator consent. See the Subprocessors page.
Network Security
| Control | Implementation |
|---|---|
| Transport encryption | The platform is served only over HTTPS, and browsers are instructed to use HTTPS for future visits. |
| Certificate management | Automated via Vercel (Let's Encrypt / DigiCert) |
| HSTS | Strict-Transport-Security: max-age=63072000; includeSubDomains; preload on Traceable platform hosts (customer custom domains use max-age=31536000) |
| API authentication | Bearer token required for all write endpoints; read-only public endpoints rate-limited per IP |
| Rate limiting | Sign-in, sign-up and one-time code requests are rate limited. See Rate Limiting. |
| DDoS protection | Vercel edge network |
Availability
Traceable targets 99.9% monthly uptime for the platform API and operator portal. Planned maintenance is communicated via the changelog and, where applicable, advance notice to operators.
The health endpoint at GET /api/health provides a real-time service status check suitable for uptime monitoring integrations.
Further Reading
| Page | Contents |
|---|---|
| Data Encryption | Encryption at rest and in transit |
| GDPR Implementation | How Traceable implements data subject rights |
| Sub-processors | Full list of third-party data processors |
| Vulnerability Disclosure | How to report security issues |