Tracepoint policy

Security at Tracepoint

Last updated August 21, 2026

Encrypted data

TLS in transit, encrypted object storage, and AES-256-GCM protected identifiers.

Tenant boundaries

Workspace-scoped authorization and opaque, non-public object keys.

Modern identity

OIDC, short-lived access tokens, MFA enforcement, and session revocation.

Recoverable operations

Encrypted backups, documented restores, health checks, and audit trails.

Upload defense in depth

Archives are accepted only from authenticated workspace members; payment status never weakens the intake controls. Tracepoint validates file size, extension, signature, checksum, archive expansion limits, and malware screening before analysis. Prepared results remain encrypted and inaccessible until their analysis run is unlocked.

Operational security

Containers run as non-root with private networks and read-only filesystems where possible.
Secrets are injected at runtime and never displayed in the administration interface.
Logs redact filenames, hashes, device identifiers, tokens, and payment details.
Privileged actions require an administration role and create immutable audit events.

Reporting a concern

A security contact and coordinated disclosure address must be configured by the operator before production launch.