TraceRoot

Security

Last updated: September 2026

TraceRoot processes traces from your AI agents, which can contain prompts, model output, and data from your systems. This page describes how we protect that data. It is written by the engineers who run the platform and kept current as the platform changes.

Where your data lives

The hosted platform runs entirely in Amazon Web Services in the United States (us-east-1). Production and staging are separate stacks with separate networks, databases, and credentials. Application services run in private subnets with no direct internet exposure; the only public entry point is a load balancer that terminates TLS.

Encryption

  • In transit: TLS 1.2 or higher for every connection to the platform and between our services and our providers. Our DNS is signed with DNSSEC.
  • At rest: the relational database, object storage, and the file system behind our trace store are encrypted with AWS-managed keys. Backups inherit the same encryption.
  • Secrets: API keys are stored hashed; integration tokens and service credentials are stored in encrypted secret stores and injected into services at runtime, never committed to source code.

Access control

  • Staff access to AWS goes through single sign-on with multi-factor authentication and least-privilege roles. Read-only access is the default; changes to production infrastructure go through code review and a second person’s approval.
  • Production credentials are never held on laptops. Deployments run from CI with short-lived credentials.
  • Access is reviewed every quarter across all our systems, and removed the same day someone leaves.
  • Within the product, workspaces isolate customers from each other; API keys are scoped to a single project.

Monitoring and response

  • Infrastructure metrics and alarms cover load-balancer errors and latency, unhealthy targets, and database capacity. Threat detection runs continuously on AWS activity, and container images are scanned on every push.
  • Kubernetes control-plane and audit logs are retained for a year.
  • We maintain an incident response plan and will notify affected customers without undue delay if an incident affects their data.

Availability and recovery

  • Databases are backed up automatically every day with 7-day retention, and we test restoring from those backups.
  • The platform is deployed from versioned infrastructure code, so an environment can be rebuilt from source.
  • Your data is exportable at any time through the API and CLI.

Secure development

  • All code changes go through pull requests with automated tests, static analysis, and dependency scanning before merge.
  • Dependencies and container base images are updated on a regular cadence; vulnerability alerts are triaged against defined timelines.
  • An external penetration test is performed annually; the current engagement is being scheduled.

Compliance

We are working toward a SOC 2 Type II report with Oneleet as our compliance partner; the audit is in progress and the report will be available under NDA once issued. HIPAA and ISO 27001 readiness follow. Policies covering access, change management, incident response, data retention, vendor management, and vulnerability management are in place and signed by every employee. Current status, policies, and our vulnerability disclosure program are in our trust center.

Reporting a vulnerability

If you believe you have found a security issue, email [email protected] or use GitHub private vulnerability reporting on our open-source repository. We acknowledge reports within two business days, and we ask that you avoid accessing other customers’ data or degrading the service while testing.

Sub-processors

The providers that handle customer data on our behalf are listed in the Privacy Policy.