Security & Trust
Traceable is built for regulated industries where data integrity, confidentiality, and regulatory compliance are not optional. This section documents the security architecture, data handling practices, and compliance posture of the platform.
Summary
| Area | Implementation |
|---|---|
| Data residency | EU infrastructure. AI features run on Anthropic's Claude models through Amazon Bedrock in the European Union |
| Encryption at rest | AES-256 encryption at rest, provided by the database provider. |
| Encryption in transit | The platform is served only over HTTPS, and browsers are instructed to use HTTPS for future visits. |
| Authentication | Supabase Auth; bcrypt password hashing; OTP support |
| API security | Bearer token authentication; HMAC signing for BMS webhooks |
| Rate limiting | Sign-in, sign-up and one-time code requests are rate limited. |
| Access control | The platform separates each customer's data from other customers' data in the application. Row-level security is enabled on database tables as a further control on direct database access. |
| GDPR | Article 15/17/20 rights implemented; DPA available on request |
| Audit logging | Security-relevant actions are recorded in an audit trail, and the records are linked by a hash chain. |
| Sub-processors | 8 sub-processors. Customer data is stored on EU infrastructure. Resend sends email from Ireland and keeps its email records in the United States, covered by Standard Contractual Clauses and the EU-U.S. Data Privacy Framework. See Sub-processors |
In This Section
| Page | Contents |
|---|---|
| Infrastructure | Hosting architecture, cloud providers, where customer data is stored |
| Data Encryption | AES-256 at rest, TLS in transit |
| GDPR Implementation | Data subject rights (Articles 15, 17, 20), lawful bases, retention |
| Sub-processors | Complete register of third-party data processors |
| Vulnerability Disclosure | How to report security issues; response SLA |
Security Contacts
For security vulnerabilities: see the Vulnerability Disclosure policy.
For GDPR requests or DPA enquiries: privacy@traceable.digital
For general security questions: security@traceable.digital
Was this page helpful?