Security & Trust
Traceable is built for regulated industries where data integrity, confidentiality, and regulatory compliance are not optional. This section documents the security architecture, data handling practices, and compliance posture of the platform.
Summary
| Area | Implementation |
|---|---|
| Data residency | EU infrastructure (Ireland + Germany); the only non-EU processing is opt-in Document AI content to Anthropic (US) under EU SCCs |
| Encryption at rest | AES-256 via Supabase / AWS KMS |
| Encryption in transit | TLS 1.3 on all connections |
| Authentication | Supabase Auth; bcrypt password hashing; OTP support |
| API security | Bearer token authentication; HMAC signing for BMS webhooks |
| Rate limiting | Upstash Redis sliding-window limits on all endpoints |
| Access control | Row-Level Security (RLS) at database layer; RBAC at application layer |
| GDPR | Article 15/17/20 rights implemented; DPA available on request |
| Audit logging | All create/update/delete/publish events logged with actor, timestamp, and resource |
| Sub-processors | 6 sub-processors; all EU-resident except Anthropic (US), used only for opt-in Document AI under EU SCCs |
In This Section
| Page | Contents |
|---|---|
| Infrastructure | Hosting architecture, cloud providers, EU data residency guarantee |
| Data Encryption | AES-256 at rest, TLS 1.3 in transit, key management |
| GDPR Implementation | Data subject rights (Articles 15, 17, 20), lawful bases, retention |
| Sub-processors | Complete register of third-party data processors |
| Vulnerability Disclosure | How to report security issues; response SLA |
Security Contacts
For security vulnerabilities: see the Vulnerability Disclosure policy.
For GDPR requests or DPA enquiries: support@traceable.digital
For general security questions: support@traceable.digital