Skip to content
Start free

Trust center

How we isolate and protect your data

Tracix is built so your telemetry never shares a database with another customer's. This page covers our architecture, access controls, compliance status and how to run a security review.

Request the security review packReport a vulnerability

Status at a glance

  • Workspace isolation

    In place

    Own Kubernetes namespace, ClickHouse database and DNS name.

  • Single sign-on and SCIM

    In place

    SAML and OIDC with a verified domain, SCIM 2.0 users and groups.

  • SOC 2 Type II

    Planned

    Audit window starts [Target date]. Report shared under NDA once issued.

  • Penetration testing

    [Status]

    [Last independent test: date and scope. Summary in the review pack.]

Architecture

Isolation is the default, not an upgrade

Every workspace, including those on the Free plan, runs in its own Kubernetes namespace on Amazon EKS with a dedicated ClickHouse cluster. Your telemetry never shares a database or a storage bucket with another customer's.

Database
ClickHouse with two replicas and three Keeper nodes per workspace
Cold storage
Object storage per workspace. Your lifecycle rules decide when data moves there and when it is deleted.
Network
Collectors connect out to your workspace, so network devices never need to reach the internet.
Hosting region
AWS us-east-1 (N. Virginia). [Region roadmap, when one is published]
Encryption
[Encryption in transit and at rest, as confirmed by the platform team]

Collector and fleet security

  • Ed25519-signed configuration on managed workspaces
  • Per-policy enrollment tokens with optional expiry, and collector credentials you can revoke
  • Updates checked against pinned SHA-256 checksums, with a preflight before the running binary is replaced
  • Device credentials in a write-only vault, encrypted with AES-256-GCM under a key unique to each workspace

Access and identity

  • TOTP multi-factor authentication with backup codes
  • Custom roles across 52 permission surfaces, and scoped API keys
  • Session limits from one hour to seven days, and audit logs

AI and automation

  • In workspaces, you choose the model provider, and an admin switch turns AI off entirely
  • Brain proposes changes and a person confirms them
  • Auto-Fix opens pull requests and never merges them

[AI data-use statement: what is sent to the provider and whether it can be used for training.]

Compliance

Where we stand, stated plainly

Planned means no audit has started yet. We update this table when an audit starts and when it finishes.

FrameworkStatusNotes
SOC 2 Type IIPlanned[Auditor and target date]
ISO/IEC 27001Planned[Target date]
GDPR[Status]See the data processing agreement and the subprocessor list.
HIPAA, FedRAMPNot offeredTalk to us about regulated workloads before sending protected data.

For your own audits, Tracix produces hash-chained evidence packs mapped to the PCI DSS v4.0, SOC 2 and ISO 27001:2022 controls it holds data for.

Security review

Four steps to review Tracix

  1. 01Read the public materialThis page, the architecture docs and the subprocessor list.
  2. 02Request the review packArchitecture detail, policies and [test summaries], shared under NDA.
  3. 03Send your questionnaireWe complete standard security questionnaires. [Supported formats]
  4. 04Meet our engineersA working session with the people who built and run the platform.