Traceway™
Book a demo
Book a demo
Security & data

Where your data goes, and who else touches it

Written for the person doing the review, not for a brochure. Everything below is either something we have verified, something we are still confirming, or something we do not have yet. And each one says which.

Reviewed 27 September 2026
No gate.
No email capture.
No “contact sales”.
What the marks mean
✓ ConfirmedVerified against the running system.
◷ In progressBeing changed right now.
◌ To confirmWe believe it, and have not verified it against production. Shown, not hidden.
○ Not yetNot the case today.
01

Where it is held

A workspace is held in the region chosen when it is set up: the United States or the European Union. Its records, its files and the database provider’s own backups stay in that region. A few things are held in the United States for every workspace; they are named below, and so is where our encrypted off-site copy of the database is kept.

✓ Confirmed
You choose the region your data is held in: the United States or the European Union.
The region is chosen when your workspace is set up. A workspace in the European Union has its own database in the EU (eu-central-1), and its records and files are written and read there only. We proved this on 2 October 2026 with a test customer, counting its records in both regions. Some things stay in the United States for every workspace. Each person’s profile (name, email address, job title, out-of-office note, planned leaving date and settings) is held once, there, because one person can belong to workspaces in more than one region. So are the company’s name and web address, so that sign-in finds the right region, and what is sent to our support: bug reports with their screenshots, and product feedback. Sign-in (Clerk), the running application (Vercel) and Trace’s AI (Anthropic) are there too. Settings → Data placement lists them for your workspace.
✓ Confirmed
A workspace’s records, files and the database provider’s daily backups are held in its region.
We state regions only, never a datacentre or an address.
✓ Confirmed
A second, encrypted copy of the database is kept off-site with Google Cloud, in the United States.
So that a failure at the database provider cannot take your records with it, a copy of the database is also held with Google Cloud in its us-east1 region, taken nightly since 27 September 2026. Each copy is encrypted before it leaves us and Google does not hold the key, so it cannot read it. Each one is restored into an empty database and compared table by table, and each is deleted after 30 days.
○ Not yet
For a workspace in the European Union, the off-site copy is kept in the EU.
Built, not yet switched on. Each EU database gets its own locked Google Cloud bucket in the EU (europe-west3), with the same encryption, 30-day retention and restore test as the United States copy, and the copy holds the database only, not uploaded files. Until it is switched on, an EU workspace’s Data placement says so, and nothing from it is sent to Google Cloud.
○ Not yet
Uploaded files in the off-site copy.
Not yet. Attachments and images are held by the database provider, but the nightly off-site copy does not include them yet.
✓ Confirmed
Customers are kept apart from one another, by application checks and by database rules.
The application works out which workspace you are signed in to and scopes its queries to it. Every table also carries database access rules (row-level security). Today most queries, about 87% measured from the database’s own statistics on 27 September 2026, run with a service key that bypasses those rules; for them, the application’s checks are what keep customers apart. The rest run with your signed-in identity and the database rules apply.
Every place your data sits
What
What is in it
Kept for
State
Records
Every decision, strategy, comment, membership record and audit event in your workspace. In its region: the United States or the European Union.
No scheduled deletion
✓ Confirmed
Files
Attachments and images you upload, exactly as you sent them, in your workspace’s region.
No scheduled deletion
✓ Confirmed
Search
Keyword search runs inside the same database, in the same region, with no search vendor, and sends nothing anywhere. Plain-English search is different: it sends your question and up to 40 records you are allowed to see to Anthropic, which picks the best matches (band 03). Both search only the environment you are working in, such as Production or Sandbox.
With the records
✓ Confirmed
Audit log
The record of who did what. Held in the same database as your records, in the same region. The only thing here with a retention setting (see band 05).
See band 05
✓ Confirmed
Backups
Daily backups taken by the database provider (Supabase), held with the database, in your workspace’s region.
Daily, kept 7 days
✓ Confirmed
Off-site backup
A nightly second copy of the database, held with Google Cloud in the United States (us-east1). For a workspace in the European Union it is not switched on yet (above). Encrypted before it leaves us; Google does not hold the key and cannot read it. Uploaded files are not in it yet.
30 days, then deleted
✓ Confirmed
Operational logs
Logs produced by the hosting provider while the application runs.
window
◌ To confirm
Staff access
When our team needs to look at your workspace to help, they enter it read-only, and only after typing a reason. The session ends in their browser after 30 minutes; the access behind it is removed by an hourly sweep, so it can last up to about 90 minutes. The person, the reason and the time bounds are written to a trail that cannot be edited, and they can end the session on the spot. What we do not have yet is your approval being asked for first. The access is recorded and bounded, not consented to in advance.
Session-scoped
✓ Confirmed
Bug reports
What you write when you report a problem, the page it happened on and, if you attach one, a screenshot with anything you blacked out already removed. Held in the United States for every workspace, including one in the European Union. The text is also sent to the model to structure it (band 03).
No scheduled deletion
✓ Confirmed
02

Who else touches it

Two lists, deliberately kept apart. The first is the one you came for: companies that can hold or see data inside a customer workspace. The second covers the website and our sales process, and touches no workspace at all. The first list is the same one, in the same order and with the same status, as the product list in our privacy policy.

The product: companies that can hold or see your workspace data
Company
What they do
What reaches them
Where
State
The database and file storage behind every record, member, audit event and uploaded file, with its own daily backups, kept 7 days.
Everything, including decision content, names, email addresses and the audit trail.
United States (us-east-2); European Union (eu-central-1)
✓ Confirmed
A second, encrypted off-site copy of the database, taken nightly and kept 30 days, so it can be restored after a disaster. Uploaded files are not in it yet.
An encrypted copy only. It is encrypted before it leaves us and Google does not hold the key, so it cannot read it.
United States (us-east1)
✓ Confirmed
Sign-in, sessions, organisation membership and invitations, and single sign-on to your own identity provider where you enable it.
Names, email addresses and sign-in events. No record content. Where you use single sign-on, no password of yours reaches them.
United States
✓ Confirmed
Runs the application, and measures page views and page performance.
Everything in transit through the application. Analytics receives page addresses (which can include a record’s identifier), device type and approximate location, never record content.
United States
✓ Confirmed
Powers Trace: drafting, extraction, search and answers. May not train models on your content.
What each feature needs: a question, a pasted document or an image; for plain-English search, the question and up to 40 records the person asking can see; for the patterns view, the titles, dates and role holders of every decision they can see. Also the background jobs, and the one place restricted decisions are not yet held back, both set out in band 03.
US company; requests may be processed outside the US
✓ Confirmed
✓ Confirmed
Supabase, Clerk, Vercel and Anthropic each have a data-processing agreement in force, covering both EU and UK transfers.
Each one incorporates its agreement automatically through its terms, and each carries a UK addendum, so the transfer mechanism exists in both regimes without a separate signature. Checked against each provider’s own published terms on 1 August 2026.
✓ Confirmed
Google Cloud has a data-processing agreement in force, for the off-site backup.
Google’sCloud Data Processing Addendum ↗is part of our Google Cloud agreement without a separate signature, and includes EU and UK standard contractual clauses for transfers. For a customer billed outside Europe, as we are, Google applies those European transfer terms once the customer confirms in Google’s console that European law applies; we have not yet confirmed that setting. Checked against Google’s published terms (last modified 8 June 2026) on 27 September 2026. What it stores is encrypted with a key it does not hold.

Integrations you connect yourself (Slack, Jira, Confluence and the like) are not our sub-processors. They are your own vendors, and data moves to them because you chose to connect them.

The website: traceway.com, demo requests and demo calls

These support the website and our sales conversations. In this role none of them touches a customer workspace. The same list, in the same order, is in our privacy policy.

Company
What they do
Where
State
CRM, website analytics, marketing email and meeting scheduling. What it receives from the Ask Trace assistant is set out in our privacy policy.
United States
✓ Confirmed
Website analytics: visitor traffic and sources. Once analytics is allowed it sets a per-browser identifier (the _ga cookie, kept about two years) so returning visits can be counted; we do not send it your name or email.
United States
✓ Confirmed
Hosts and delivers the website.
United States
✓ Confirmed
Turnstile, the bot and spam check that runs when you submit a form.
United States
✓ Confirmed
The AI behind the Ask Trace assistant on the website. Chat messages are sent to generate replies and are not used to train models.
US company; requests may be processed outside the US
✓ Confirmed
Video calls for demos.
United States
✓ Confirmed
AI recording, transcription and notes for demo calls.
United States
✓ Confirmed
Business email and calendar.
United States
✓ Confirmed
03

The AI question

For a product with an AI assistant this is the first thing anyone asks, so it gets the most space and the most sourcing.

✓ Confirmed
Anthropic may not train models on your content, and neither do we.
Trace runs on Anthropic, whose Commercial Terms state that Anthropic may not train models on Customer Content, defined as the inputs submitted and the outputs returned. It is a published term you can read yourself rather than take from us (their statement ↗).
✓ Confirmed
Traceway trains no model either.
Trace does adjust its own suggestions inside one workspace, from the suggestions people there explicitly accept or override: role and classification suggestions today. Any member can see what it has learned at Settings → Trace → Learning, and an admin can make it unlearn any of it. Nothing learned in one workspace reaches another, and no model is trained or fine-tuned on it. There is no shared corpus across customers.
✓ Confirmed
Your records go to the model when a feature needs them, including three jobs that run in the background.
A question you ask, a document you paste, an image you upload. Some features send many records in one request: plain-English search sends your question and up to 40 records you can see; the patterns view sends the title, status, dates and role holders of every decision you can see, not what they say. Three jobs run without anyone watching: finishing the extraction of a bulk import someone started; extracting decisions from Slack threads someone in your workspace captured, every 15 minutes; and a daily Microsoft Teams check built to compare later Teams threads with approved decisions, which today reads no threads and sends nothing. Scheduled Jira imports copy fields and send nothing to the model.
✓ Confirmed
Rating a Trace answer sends nothing to the model provider.
This matters more than it sounds. The no-training term carves out content a customer explicitly submits as feedback, which makes a thumbs-up button a training pipeline unless it is deliberately built not to be. Ours records the rating and which answer it refers to, in your own workspace, and stops there.
✓ Confirmed
Filing a bug report does send its text to the model.
When you report a problem, the text of your report is sent to the model to structure it into a reproducible ticket. We would rather say so here than have it found.
✓ Confirmed
Trace stays inside the environment you are working in.
In the product, Trace’s answers and both kinds of search read only the environment you are signed in to, such as Production or Sandbox. They do not reach your company’s other environments, or any other company. The Ask Trace assistant on this website reaches no workspace at all: it answers only from material we have published.
✓ Confirmed
Trace only uses decisions the person asking could open themselves.
A restricted decision stays restricted. When one you are not part of matches your question, Trace is told only that a restricted decision exists, never its title or what it says, so it can tell you there is one rather than use it. The same holds for search, the home summary, the patterns view and link suggestions.
○ Not yet
The same for the duplicate check during a bulk import.
Not yet. When someone runs a bulk import, the check for duplicates sends the title and one-line summary of every decision in the workspace to the model, including restricted decisions that person cannot open. Until that is fixed, we do not claim the rule above for every AI request. Which is exactly the kind of thing this page exists to say out loud.
○ Not yet
Choosing your own model vendor, or using your own model deployment.
Not available today.
On how long the model provider keeps a request: that is their fact, published in their own documentation, and we point you there rather than paraphrase it. We draw the distinction deliberately: “not trained on” and “not stored” are different sentences, and we have not arranged the second.
04

What the audit trail proves

Every governance product claims an audit trail. Almost none of them say what it cannot establish, and a reviewer who finds a limit we did not mention discounts everything we did. So the right-hand column is published on purpose.

It proves
✓Who acted, and when. Actor, action and timestamp for every governance event.
✓The sequence in which a record was drafted, reviewed, approved, superseded or revisited.
✓What an approval locked: once a decision is approved, its decision statement and its “why now” can no longer be edited. Its success criteria, custom sections and discussion stay editable, and later edits are recorded in the trail.
✓That a sealed export has not been altered since it was produced.
It does not prove
✕That the approver read it. It records that an account with approval authority clicked approve. Attention is not observable.
✕That the named human was at the keyboard. It proves an authenticated session. A shared credential or an unlocked laptop is outside what any log can see.
✕That the decision was right. It is a record of process, never of judgement.
✕That nothing happened elsewhere. A decision made in a corridor and never captured leaves no trace here.
✕That a linked system did what it said. A ticket referenced by a decision is evidence about that tracker, held by that tracker.
✓ Confirmed
Audit rows are chained to their predecessor, so a deletion inside the trail is detectable.
Chaining has been in place since 27 June 2026 and covers every event created from that date onward. Events recorded before it are sealed at export but not chained. A reviewer who assumed the entire history was chained would have been misled by omission, so the boundary is stated rather than the headline.
✓ Confirmed
There is no way to edit or delete an audit event in the product.
Not for an admin, not for a workspace owner, and not through any screen we operate. Some Traceway staff do hold administrative access to the database itself, as its administrators. So what we are claiming is that no product path exists, not that the underlying store is beyond human reach. Anyone claiming the stronger version has not thought about their own database administrators.
05

How data leaves

Reviewers ask how data gets out because they are really asking whether they can leave.

✓ Confirmed
Any workspace admin can export the whole workspace, at any time, without asking us.
Decisions, strategies, comments, files, members and audit events, at most once an hour. The admin types the workspace’s name to confirm, and the finished archive can be checked against its fingerprint to prove it has not been altered.
✓ Confirmed
Your audit-log retention window is a setting you control.
One, three or seven years, or keep everything. Seven years is the default, and only a workspace admin can change it.
○ Not yet
Old audit events being deleted automatically when they pass that window.
The job that deletes them is built and runs on the first of each month, but its delete step is switched off (its last run, on 1 September 2026, was a dry run), so it deletes nothing; today we keep audit events until you ask us to remove them. Deleting audit history permanently is high-stakes and we would rather switch it on carefully than early. This is the single thing on this page most likely to be assumed rather than checked, so it is stated plainly.
✓ Confirmed
Erasing one person from a workspace on your own.
A workspace admin can do it at Settings → Users, from the person’s page. Wherever their name is only displayed, it becomes “Former member”. Where it was captured as part of a governance act (an approval, a ratification, a delegation), it is kept, deliberately: you cannot un-sign a contract by asking to be forgotten, and a decision record whose approver can vanish proves nothing. Each erasure produces a receipt.
✓ Confirmed
Deleting your workspace yourself, with your data offered back first.
A workspace admin can do it at Settings → Workspace. The flow offers a full export first, and if you choose not to take one, that choice is written on the deletion certificate. The admin types the workspace’s name to confirm; everyone is signed out; any admin can restore it for 30 days; then it is permanently deleted and a certificate of deletion is issued.

While the workspace exists, your decisions and files are never on a deletion clock. The retention setting above governs the audit log (the record of events) and nothing else. One thing to know when you delete a record yourself: it stays in the database backups described in band 01 until those copies expire (7 days at the database provider, 30 days for the off-site copy), and is then gone.

06

Notice of change

✓ Confirmed
A new company is listed here before it receives any of your workspace data.
It is added to the list in band 02, and to the product list in our privacy policy, with its date, before any workspace data reaches it. Every addition, removal and replacement is recorded in the table below.
○ Not yet
Advance notice by email to every workspace administrator, with a route to object.
Not today. The list on this page, and the same list in our privacy policy, is the notice there is. When emailed notice exists, this line will say so.
Changes to the product list
Date
Change
27 September 2026
Google Cloud added, for the encrypted off-site backup.

What we do not publish, and why. Software versions, hostnames, internal architecture and the security tooling we run stay off this page; they answer no question a reviewer actually has, and they tell someone where to knock. Anything a reviewer genuinely needs that is not here, we give on request: a completed security questionnaire, or a current statement of what we do and do not yet have.

Something here unmarked, or a question this page does not answer?
Ask us at security@traceway.com and you will get the current position in writing, including where the answer is “not yet”. If you believe you have found a vulnerability, that is the same address and we will confirm receipt.
Last reviewed 27 September 2026. Every claim on this page carries its state.
Anything unmarked, ask. We would rather answer than have you assume.