GainTrace

Access and governance controls your admins use inside GainTrace.

• Sign in with Google or Microsoft

  Members can sign in with their Google Workspace or Microsoft account instead of a password.

• Multi-factor authentication

  Members can protect their account with an authenticator app, email codes and backup codes.

• Custom roles with granular permissions

  Owner, admin and member roles, plus custom roles built from more than 50 individual permissions.

• Workspace audit log

  Sign-ins, admin changes and AI agent actions are recorded, and admins can export the log.

• Time-limited, logged support access

  If our support team ever signs in as you, they must give a reason, the session ends within one hour, and it appears in your audit log.

• Field policies for contact data

  Admins can redact or hide contact email, phone and LinkedIn fields by role.

• Secure sessions

  Session cookies are HttpOnly, Secure and SameSite, and sessions expire after 7 days without use.

Where your data lives and how it is protected.

• Customer data hosted in the EU

  Our production database and its backups are in AWS eu-west-1, Ireland.

• Encryption at rest with AES-256

  The production database is encrypted at rest with AES-256.

• Encryption in transit

  Every connection to GainTrace uses TLS, and browsers are held to HTTPS with HSTS.

• Integration credentials encrypted with AES-256-GCM

  OAuth tokens and API keys for the tools you connect are encrypted again at the application layer before they are stored.

• Encrypted, separated backups

  The database is backed up every night to separate storage encrypted with AWS KMS, which the application server cannot delete.

• API keys stored as hashes

  Workspace API keys are shown once and stored only as hashes.

• Passwords hashed with scrypt

  We never store passwords in plain text.

• Workspace-scoped data access

  Every request is tied to your signed-in workspace membership, and data access is scoped to that workspace.

How we build, test and ship GainTrace.

• Automated checks on every release

  Every production release passes type checks, automated tests and a production build first.

• Short-lived deploy credentials

  Deployments use short-lived cloud credentials, never stored keys.

• Automatic rollback

  A release that fails its health checks is rolled back automatically.

• Dependency updates

  Dependencies are updated weekly, and security fixes are raised as soon as they are published.

• Container image scanning

  Every application image is scanned for known vulnerabilities when it is pushed.

• Least-privilege runtime

  The application runs as a non-root user inside its container.

• Rate-limited authentication

  Sign-in, sign-up and password reset are rate-limited.

• Signed webhooks

  Inbound webhooks are verified before we process them, and webhooks we send are signed with HMAC-SHA256.

• No secrets in source code

  Credentials are kept out of the code repository, with checks before code is committed and deployed.

How traffic reaches GainTrace, and what it cannot reach.

• No open web ports

  All web traffic reaches the application through an encrypted Cloudflare Tunnel.

• Database isolated from the internet

  The database has no public endpoint and accepts connections only from the application server.

• Edge protection by Cloudflare

  Traffic is served through Cloudflare's network, which absorbs denial-of-service attacks.

• External uptime monitoring

  GainTrace is checked from outside our infrastructure every 30 seconds, with alerts to the team.

The laptops our team works on.

• Company Apple MacBooks only

  Every company computer is a MacBook running macOS.

• Full-disk encryption with FileVault

  Turned on for every company Mac.

• Automatic security updates

  macOS and security updates install automatically.

• Firewall enabled

  The macOS application firewall is on.

• Password and auto-lock

  Every Mac requires a password and locks itself when left unattended.

Our people, policies and suppliers.

• Two-factor authentication everywhere

  2FA is required on every service our team uses.

• Security training for every employee

  Each employee completes IT security awareness training.

• Documented security policies

  42 policies, procedures and program documents, approved by management and reviewed every year.

• Controls mapped to SOC 2 criteria

  Our controls are mapped to every SOC 2 Trust Services Criterion.

• Documented incident response

  A written process to detect, contain and recover, with a 48-hour customer notice commitment in our DPA.

• Public sub-processor list

  Every provider that processes personal data for us is listed, with 30 days' notice before we add one.

How GainTrace's AI features use your data.

• No storage at our AI provider

  Trace AI runs on OpenAI's API with response storage switched off on every request. OpenAI may keep request logs for up to 30 days for abuse monitoring.

• No training on API data

  OpenAI's API terms bar it from training on the data we send.

• Prediction models trained per workspace

  Churn and expansion models learn from your workspace's data only, and serve only you.

• Human confirmation for every change

  Trace AI never changes your data on its own. Every change it proposes needs a member to confirm it.

• Untrusted content stays untrusted

  Text from emails, CRM notes and transcripts is treated as untrusted data in AI prompts, never as instructions.

• Bring your own AI key

  Use your own AI provider key, encrypted and bound to your workspace.

• Workspace AI off switch

  Admins can turn Trace AI off for the whole workspace.