Frequently asked questions
Something not covered here? Email [email protected], or send us your security questionnaire.
Where is our data stored?
Our production database and its backups are in the European Union, in AWS eu-west-1 (Ireland). Some processing happens outside the EEA: our team works from India, and providers such as OpenAI (for AI features) and Resend (for email) are in the United States. Those transfers run under the 2021 EU Standard Contractual Clauses and the UK Addendum. Every provider is on our sub-processor list.
How is our data encrypted?
In transit with TLS 1.2 or higher, and at rest with AES-256. The credentials for the tools you connect, such as OAuth tokens and API keys, are encrypted a second time at the application layer with AES-256-GCM, and database backups are encrypted with AWS KMS.
Do you sign a Data Processing Agreement?
Our DPA applies to every subscription by default, so you do not need to sign anything for it to protect you. If your process needs a countersigned copy, email [email protected] and we will sign it.
Is our data used to train AI models?
No. Trace AI runs on OpenAI's API, whose terms bar OpenAI from training on the data we send, and we switch response storage off on every request (OpenAI may keep request logs for up to 30 days for abuse monitoring). Our churn and expansion models are trained per workspace: they learn from your data only and serve only you. Any improvement across customers uses de-identified, aggregated data only.
Which security frameworks do you follow?
Our security program and its 42 policies are mapped to the SOC 2 Trust Services Criteria: security, availability, confidentiality, processing integrity and privacy. On privacy, we work to GDPR, the UK GDPR and the CCPA. You can request the full control matrix from the Resources tab.
Can we control who sees what inside GainTrace?
Yes. Under Governance, admins can build custom roles from more than 50 permissions, redact or hide contact fields by role, and switch Trace AI off for the whole workspace. Sign-ins, admin changes and AI agent actions are all recorded in the audit log, and our own support team can only access your workspace with a stated reason, for at most an hour, in a way that shows up in that log.
What happens if there is a security incident?
We follow a documented incident response plan. If a personal data breach affects your Customer Data, we notify you without undue delay, and no later than 48 hours after we become aware of it, with the information you need to meet your own obligations.
What happens to our data if we leave?
You have 30 days after your subscription ends to export your data. After that we delete it, and backup copies roll off within 90 days at most, as set out in section 11.6 of our Terms of Service.
How do you secure your team's laptops and accounts?
Every company computer is an Apple MacBook running macOS, with FileVault full-disk encryption, automatic security updates, the firewall on, a password and auto-lock. Two-factor authentication is required on every service we use, and every employee completes security awareness training.
Will you fill in our security questionnaire?
Yes. Send it to [email protected]. Most questions are answered by the documents in Resources, which we can share alongside it.
How do we report a vulnerability?
Email [email protected] with the steps to reproduce. Please give us reasonable time to fix the issue before you disclose it, and do not access other customers' data, degrade the service or use social engineering. We will not take legal action against good-faith research that follows these rules.