Security

TraceLoom runs on Vercel for application hosting and Supabase for the database, authentication and file storage. The production database is a single Supabase Postgres instance in AWS us-east-2 (Ohio, United States). Application functions run in Vercel's US East region, and static assets are served from Vercel's global network.

Vercel and Supabase publish their own security attestations, such as SOC 2 reports. Those cover their platforms and belong to them; they are not certifications held by TraceLoom. We do not offer hosting in the EU or in any other region today.

In transit: The website and the application are served over HTTPS with TLS 1.2 or higher, terminated by Vercel. Calls from the application to Supabase also use HTTPS.

At rest: The database and file storage are encrypted at rest by Supabase on AWS. TraceLoom does not manage those encryption keys.

Secrets and credentials: Passwords are handled by Supabase Auth, which stores only a salted hash. The shared secret for ERP push integrations is stored only as a SHA-256 hash, so we can verify it without keeping it. Application secrets are held in Vercel's environment-variable store, and the keys that can bypass tenant isolation are used only on the server and are never sent to a browser.

Sign-in is by email and password through Supabase Auth, and a single server-side gate checks every request to the logged-in application. Multi-factor authentication and single sign-on are not available in the product today.

Access to an organisation is by invitation. Invitation links are tied to the invited email address and expire. Each member has a role that limits which parts of the product they can use and change.

Every API route either authenticates the caller or sits on a short, reviewed list of public routes, and an automated test fails the build if a new route ships without one.

TraceLoom staff reach customer data through a super-admin console. When staff act inside a customer organisation for support, the start and end of that session are written to that organisation's audit log.

Tenant data tables use Postgres row-level security (RLS). The database works out the tenant boundary from the logged-in user's organisation, so the database, and not only the application, decides which rows a request can read or write.

An automated cross-tenant test in our repository impersonates a user of one organisation and asserts that no rows from another organisation are visible, across the tables that hold sensitive data. A daily check against Supabase's security advisor, which also runs on every push to the main branch, opens an issue when a new unreviewed finding appears, such as a table without row-level security.

Application logs are kept by Vercel and database logs by Supabase. Changes to key records (suppliers, emissions records, scan events, scorecards, alerts and workers) are written to an audit log by database triggers, and a number of actions in the application add their own entries. Administrators and compliance leads can view and download their organisation's audit log from Settings.

The production database has no point-in-time recovery and no standby replica, and it runs in a single region. We do not currently publish a recovery-time or recovery-point commitment. If you need one for a contract, email security@traceloom.co and ask for the current state of our backups before you rely on them.

If we become aware of a personal-data breach affecting data we process for you, we will notify you without undue delay and in any case within 72 hours, as set out in our DPA. We will tell you what happened, which data was involved and what we are doing about it.

We would rather you read these here than discover them in a questionnaire.

Certification: We have not started a SOC 2 audit and hold no third-party security certification.

Penetration testing: We have not yet commissioned an independent penetration test.

Sign-in: Sign-in does not yet offer multi-factor authentication or single sign-on (SAML or OIDC).

Staff access: Staff access to customer data is protected by authentication and logging. We do not yet have separation-of-duty controls on it.

Regions: One production region. There is no EU hosting option today.

GDPR, CSRD and the Digital Product Passport: We build toward readiness for these. Our DPA and Privacy Policy set out what we commit to as processor and controller. Nothing here is a regulatory certification, approval or legal advice, and the Digital Product Passport rules under ESPR are still being finalised.

The full list of sub-processors, including region and what each one receives, is published in section 4 of our DPA. We give 30 days' notice before adding or replacing a sub-processor.

If you discover a security vulnerability in TraceLoom, we want to hear about it. Use the form below or email security@traceloom.co. Please keep exploit details and customer data out of the first message; we will reply with a way to share them.

In scope: traceloom.co, app.traceloom.co, *.traceloom.co (excluding marketing landing pages), and our publicly documented APIs. Out of scope: social engineering, denial-of-service, physical security, third-party services we don't control.

Safe harbour: good-faith research within scope is authorised. We will not pursue legal action against researchers who disclose responsibly and avoid violating customer privacy or destroying data.

Where is my data stored? In the primary Supabase database in AWS us-east-2 (Ohio, United States). We do not offer EU or other regional hosting today.

Can I require multi-factor authentication for my organisation? Not today. Sign-in is by email and password.

Do you support SSO? Not today.

Do you hold a SOC 2 report or have a recent penetration test? No. See section 8.

Where can I get a security questionnaire answered? Email security@traceloom.co with the document. We will answer what our current controls support and say plainly where we do not meet a requirement.