security

Security posture.

Tracelane is designed for procurement reviews at regulated buyers. This page describes the service's controls, data handling and deletion boundaries.

Security controls

• Workspace authorization and tenant-scoped database queries separate customer data.
• Provider keys use envelope encryption bound to the workspace and provider.
• The gateway origin is configured for TLS 1.3. The public edge and the internal messaging path have different transport boundaries; see the security documentation.
• Release controls include Cosign signatures, build provenance and CycloneDX software bills of materials. Dependency and secret scanning are automated checks.

The ledger covers gateway-admitted calls and their recorded guardrail verdicts; SDK/OTLP-only spans are captured, not chained; the trace ledger badge shows whether that trace has a ledger record. See ledger coverage and verification.

Service providers and storage

Gateway compute and the primary trace and account databases are in Germany. This is not an EU-only processing promise: the service also uses global edge services, a secondary backup outside the EU-jurisdiction bucket, and identity, payment and email providers whose processing locations are provider-managed. Customer-selectable region pinning is not offered.

Hetzner

Gateway and ingest compute, messaging, and ClickHouse hot storage. Falkenstein, Germany.

Cloudflare

CDN and Workers for the website and dashboard; D1 for the website updates list; R2 for cold trace storage and backup archives. Edge and website processing is global; cold storage and primary backups use the EU jurisdiction. The secondary backup uses Cloudflare's default jurisdiction, without an EU-only restriction.

Neon

Postgres for accounts, workspace settings, encrypted provider credentials, billing metadata, and the canonical audit ledger. Frankfurt, Germany.

WorkOS

Authentication, users, organizations and workspace membership. Provider-managed locations.

Polar

Subscriptions, payment processing and invoicing. Provider-managed locations.

Resend

Transactional billing and usage emails when email delivery is configured: recipient address and notification content. Provider-managed locations.

Model providers receive requests selected by your application using your own provider credentials. Their retention and deletion policies apply to those requests. Audit anchoring also uses the public Sigstore Rekor transparency log for hashes, rather than trace payloads. See the security documentation for that boundary.

Retention

Captured traffic has a plan-defined queryable history: 30 days on Free and 730 days on paid plans. The indexed window controls the recent range used for fast queries; it is not the deletion window. The retention sweep removes traffic older than the workspace's effective queryable window. Curated datasets and experiments are outside that traffic sweep. See pricing for the plan windows.

Audit ledger records and their verification anchors are retained separately, including after workspace deletion. Deleting a workspace does not remove its history from the tamper-evident ledger.

Workspace deletion and recovery

An owner can delete a workspace in Settings by confirming its name. This archives the workspace and marks its API keys revoked; access checks take effect as authorization caches refresh. Contact support during the 30-day recovery window if the deletion was accidental. The purge job selects workspaces archived for more than 30 days. Failed purges need operator review and deletion-status confirmation; this is not an immediate wipe or a guarantee that every copy disappears on day 30.

The purge removes classified tenant data from the online telemetry and account stores, including stored provider-key rows, while retaining ledger records and anchors. It checks the target rows and other tenants' row counts. An unclassified tenant table stops the purge for review. Identity-provider deletion and subscription cancellation are best-effort steps and need separate confirmation if they fail.

Shared backup archives are not rewritten for each workspace deletion; backup pruning and storage lifecycle rules are separate from the workspace purge. Vendor-held billing records and data already sent to your model providers have their own retention rules. For a deletion-status confirmation, a personal-data request, or removal from the website updates list, contact support@tracelane.dev.

Procurement review

Request the current data-processing terms and supporting security information from support@tracelane.dev. The controls and ledger exports described here support your review; they do not establish that your application meets a regulatory obligation.

Responsible disclosure

Report security issues to security@tracelane.dev. We acknowledge within 72 hours and target a 30-day patch for critical vulnerabilities.

Last updated: September 22, 2026.