Trust Center

traceunified publishes security and privacy materials for customers and prospects at this Trust Center. Version 2026-10-16.

Legal documents

Data Processing Addendum — https://traceunified.com/legal/dpa

Subprocessors — https://traceunified.com/legal/subprocessors

Security architecture

Controls live in the architecture, not in a policy.

Isolation — Isolated database per customer. Dedicated: own database cluster and KMS key. Self-hosted and air-gapped option.

Data — Encrypted at rest with KMS and in transit. AWS Backup plans. Restore drills on production backups.

Access — SSO, SAML, SCIM, role-based access. Server-enforced Part 11 re-auth. Tamper-evident audit trail.

Monitoring — AWS WAF in front of the app. GuardDuty, CloudTrail, Security Hub. 100+ build gates and dependency audits.

Runs on AWS: containers on ECS, PostgreSQL on RDS clusters, infrastructure defined as code. AI is bring-your-own-model and advisory only; no customer data trains a shared model.

Vulnerability disclosure: security@traceunified.com. No information system is invulnerable. Customers must configure SSO/MFA, manage access, and follow their own validation and quality procedures for regulated use.

Compliance posture

The platform is designed to support FDA 21 CFR Part 11, ISO 13485, IEC 62304, and similar frameworks. traceunified is pursuing SOC 2 Type I then Type II; until a report is issued, do not treat readiness materials as an attestation.

Incident reporting

Report vulnerabilities and suspected security incidents to security@traceunified.com. Confirmed incidents affecting customer personal data are notified within 72 hours under the DPA.

Contact

Security: security@traceunified.com. Privacy: privacy@traceunified.com. Legal: legal@traceunified.com.