Data in transit
All traffic to the ingest API and all webhook delivery happen over TLS. Every
webhook is signed with HMAC-SHA256 using a per-subscriber secret
so your receiver can prove a request genuinely came from TraceItX and was not
altered in flight. The signature and a timestamp travel in the
X-TraceItX-Signature header (format t=<unix>,v1=<hex>),
and the timestamp lets you reject replayed requests. See
verifying webhooks for the exact algorithm.
Data at rest
SDK keys and webhook signing secrets are stored encrypted; SDK keys are looked up by a keyed hash rather than kept in plaintext. Report artifacts are stored only for the delivery window and then deleted automatically.
Retention & data minimisation
Report artifacts — screenshots, recordings, logs, and the stored envelope — are retained for a maximum of 30 days, the window needed to deliver, retry, and dead-letter a webhook, then purged. You control what your SDK captures and can redact sensitive fields before submission, so the smallest useful payload is the one that leaves the device. See data & retention.
Abuse & integrity controls
- SSRF protection. Webhook destinations are validated before delivery; requests to internal or disallowed network ranges are blocked.
- Rate limiting. The ingest API is rate-limited per SDK key and per source IP to absorb abuse without affecting healthy traffic.
- Payload limits. Uploads are size-capped and decompression is bounded to guard against malformed or hostile payloads.
- Idempotency. Duplicate submissions are de-duplicated so an SDK retry never fans out a report twice.
- Delivery circuit breaker. A receiver that fails repeatedly is automatically paused to protect both sides, with a clear reason you can see in the delivery log.
Reliable, signed delivery
Failed deliveries are retried on a backoff schedule across roughly four days before a report is dead-lettered, and every attempt carries a fresh delivery id and attempt counter so your receiver can reconcile exactly what happened.
Sub-processors & hosting
We run on a small set of vetted infrastructure providers, each bound by a data-processing agreement. A current list is available on request. We aim to process data within the European Economic Area; see our Privacy Policy for transfer safeguards.
Responsible disclosure
If you believe you’ve found a vulnerability, please email support@traceitx.com with enough detail to reproduce it. We’ll acknowledge your report, investigate, and keep you updated. Please give us a reasonable chance to fix the issue before any public disclosure, and avoid accessing or modifying data that isn’t yours while testing.
Common questions
Do you use our bug reports to train AI models?
No. Report contents are processed only to deliver them. We do not train models on your data and we do not sell or share it.
Can I verify a webhook actually came from TraceItX?
Yes. Recompute the HMAC-SHA256 of <timestamp>.<raw-body> with your signing secret and compare it, in constant time, to the v1 value in the signature header. Full code is in the webhooks guide.
Where is data stored, and for how long?
Within the EEA where possible, and only for the 30-day delivery window for artifacts. See data & retention.
Do you offer a DPA?
Yes — email support@traceitx.com to request our Data Processing Agreement.