Your documents are your evidence. We protect them that way.
Teams put their design history, risk files and signed records in Traceable. This page sets out how we protect that data, how we test the protections, and which standards we build to, including the ones we have not reached yet.
Controls in the product today
Where your data is hosted
Traceable runs on Amazon Web Services (AWS) infrastructure in Sydney, Australia, where your documents, files and account data are stored.
Encryption
Data is encrypted in transit with TLS, between your browser and Traceable and between Traceable and its database and file storage, and encrypted at rest by our cloud infrastructure.
Organisation isolation
Every read and write checks that you belong to the organisation and project concerned before anything is returned. Row Level Security on every database table also blocks direct access from outside the application.
Private file storage
Attachments and published PDF snapshots are held in private storage. Every file request is authorised individually against your membership before the file is served.
Signatures you can stand behind
Signing a document sends a one-time code to the signer’s email, so a signature confirms the person, not just the session. Each signature records who signed, in what role, and when.
A record that cannot be rewritten
Every change is attributed in a row-level change log, and each publication locks an immutable PDF snapshot of exactly what was approved.
Separated environments and data
Development and preview environments run on their own databases, never on customer data. Customer documents are kept in a separate database from our own business records.
AI on your terms
The built-in Assistant uses only AI models run with zero data retention. External AI connections are off by default, enabled per person by your administrator, act under your own permissions, and can be revoked immediately.
Controlled releases
Organisations under controlled releases receive new features switched off, until one of their administrators turns them on, so a validated configuration does not change underneath you.
How we test it
Security fixes are verified against a written, repeatable penetration test protocol. Each test is a specific hypothesis with a pass criterion, run against our preview environment with throwaway data, never against customer data. A fix is retested on its own and with every related test, and the full suite runs again after any change to authentication, access control or file storage.
Findings are tracked in a vulnerability register. A release does not go to production with an open high-severity finding.
The standards we build to, and where we are
Traceable is aligned with these standards. Using it does not by itself make an organisation compliant or certified, and we are clear about what we have and have not achieved.
| Standard | Covers | Where we are |
|---|---|---|
| FDA 21 CFR Part 11 | Electronic records and signatures | Built into the product: Part 11 compliant e-signatures on the Regulated plan, with an audit trail and record protection. |
| EU GMP Annex 11 | Computerised systems | Mapped against the product and our own practices. |
| GAMP 5 | Risk-based computer system validation | The method our own validation follows, so your validation effort can focus on your configuration. |
| ISO/IEC 27001:2022 | Information security management | Our controls are mapped against Annex A. We are not certified. |
| SOC 2 Type 2 | Trust services criteria | On our roadmap. No report has been issued. |
| Privacy Act 1988 (Australia), GDPR, PIPEDA | Data protection | Our privacy practices follow their principles. Australia is our home jurisdiction. |
| WCAG 2.2 AA | Accessibility | The accessibility level we are working to. |
Privacy
We collect only what we need to run the service, we do not sell personal information, and our providers process it only on our behalf. The Privacy Policy sets out what we hold, why, and your rights over it.
Reporting a security issue
If you believe you have found a vulnerability in Traceable, please tell us through the contact page before disclosing it publicly. We will acknowledge your report, investigate it, and keep you informed of what we do about it.
Need more detail for your supplier assessment?
Tell us what your quality or security team needs to see, and we will work through it with you.