security

Security posture.

Tracelane is designed for procurement reviews at regulated buyers. This page documents what's verifiable today and what's on the roadmap.

Release integrity

• Sigstore Cosign keyless signing on every release artifact.
• Build provenance attested with GitHub attest-build-provenance. Every GitHub Action pinned by commit SHA. A verified SLSA Level 3 attestation is not claimed.
• Trusted Publishing OIDC for PyPI and npm. No long-lived registry tokens in CI.
• CycloneDX SBOM published with every release, verifiable from GitHub release artifacts.

Vulnerability management

• gitleaks, cargo-deny and a critical-level dependency audit on every push; OSV-Scanner and Grype nightly and a Syft SBOM weekly on the public repository.
• gitleaks on every commit to block secret leaks.
• GitHub Security Advisories enabled for coordinated disclosure.
• cargo-deny enforces the dependency and license allow-list on every build.

Transport + isolation

• TLS 1.3 minimum.
• mTLS via SPIFFE/SPIRE for ingest workers.
• SSRF defense — RFC1918, 100.64/10, 169.254/16, ::1, fc00::/7 all denied. file:// and gopher:// schemes blocked. Redirects are disabled entirely on the hardened client, so a validated host cannot hand off to an unvalidated one.
• rustls + aws-lc-rs + ring crypto stack. No openssl.

Tenant isolation

• BYOK only. Provider keys envelope-encrypted at rest. Never written to logs or spans.
• secrecy::SecretString + Zeroize-on-drop for all in-memory credentials.
• Every ClickHouse query enforces WHERE tenant_id = ? from JWT claim, never request body.
• Enforced in the query layer and checked in CI: a query without the tenant filter fails the build.

Containers + supply chain

• Chainguard Wolfi base images only. Distroless. No shell, no package manager in runtime image.
• GitHub Actions pinned by SHA, never by tag.
• Custom tracing redaction layer scrubs secrets before they hit any log sink.

Compliance roadmap

• SOC 2 — Tracelane holds no SOC 2 report today and none is in progress.
• HIPAA — Tracelane does not sign BAAs today. Hetzner, our infrastructure provider, does not sign them either.
• EU AI Act Article 12 — an Article 12 documentation pack ships with the Tamper-Evident Agent Ledger add-on. It generates evidence templates locally; it is not a conformance assessment and Tracelane makes no representation that deploying it satisfies any obligation. Annex III enforcement provisionally deferred to Dec 2, 2027 (Digital Omnibus political agreement, May 7, 2026; pending formal adoption — details).
• India DPDP Phase II — Tracelane enforces no per-tenant storage region today; region pinning is on the roadmap. Enforcement Nov 13, 2026.

Responsible disclosure

Report security issues to security@tracelane.dev. We respond within 24 hours. Bug bounty program within 30 days of the V1 release.

Last updated: May 20, 2026.