1. Introduction and Roles
This Privacy Policy explains how traceunified ("traceunified," "we," "us," or "our") collects, uses, discloses, and safeguards information in connection with the traceunified platform and related websites (the "Service"). Document version 2026-10-11.
For Customer Data that organizations submit to the Service, traceunified generally acts as a data processor (or service provider) on behalf of the customer organization, which acts as the data controller (or business). We process that data according to the customer's instructions, the applicable agreement, and this Policy. For account administration data we collect to operate our business relationship (such as billing contacts), we may act as a controller.
This Policy is effective as of the date above. Our Data Processing Addendum at https://traceunified.com/legal/dpa controls for Personal Data processing terms to the extent of any conflict. Trust and security materials: https://traceunified.com/legal/trust.
2. Information We Process
Account and identity information: name, email address, organizational affiliation, role or group membership, authentication identifiers, and related metadata received through SSO, SCIM, security keys, or invitation flows.
Usage, security, and audit information: login events, access decisions, configuration changes, IP addresses and user-agent data associated with requests, diagnostic logs, and tamper-evident audit trails maintained for security and regulatory support. Operational logs are designed to avoid embedding record content where practicable.
Customer Data: requirements, tests, risks, architecture models, comments, attachments, electronic signatures, and other content the customer organization chooses to store in the Service. The customer controls this content.
Support and communications: information you provide when contacting support or legal, and transactional email metadata when we send password resets, invitations, or service notices.
We do not intentionally collect special-category or sensitive personal data as a product feature. Customers should not submit such data unless separately agreed in writing.
3. How We Use Information
We use information to: provide, operate, maintain, and secure the Service; authenticate users and enforce access controls; maintain audit, electronic signature, and compliance-support records; detect, prevent, and investigate security incidents, abuse, and fraud; provide customer support; communicate service-related notices; improve reliability and performance; and comply with law and enforce our agreements.
We do not sell Personal Data. We do not use Customer Data for third-party advertising. We do not use Customer Data to train publicly available foundation models. Optional AI features, when enabled by the customer with the customer's own provider key, transmit user-invoked content to that provider under the customer's agreement with the provider.
4. Legal Bases (Where Applicable)
Where GDPR, UK GDPR, or similar laws apply to our role as controller, we process Personal Data based on: performance of a contract; legitimate interests in securing and operating the Service (balanced against individual rights); consent where required; and legal obligations. Where we act as processor, the customer's legal bases govern the underlying processing, and we process on documented instructions.
5. Sharing and Subprocessors
We share information only as needed to operate the Service: with infrastructure and email subprocessors under contractual safeguards; with the customer's administrators and Authorized Users as configured by the customer; with professional advisors under confidentiality; and when required by law, legal process, or to protect the rights, safety, and security of users, the public, or the Service.
Current subprocessors (including Amazon Web Services for hosting in the United States, Cloudflare for DNS/edge where used, and Zoho Mail for transactional email when the customer has not configured its own transport) are listed at https://traceunified.com/legal/subprocessors. We notify customers of material subprocessor changes at least 30 days in advance as described in the DPA.
Customer-chosen AI providers and customer-configured email transports are not traceunified subprocessors; they process data under the customer's own arrangements.
6. Security Measures
We implement technical and organizational measures designed to protect information, including encryption in transit (TLS) and encryption at rest for hosted data stores; role-based access control; optional SSO enforcement and multi-factor authentication; tenant isolation; secrets management; security monitoring; and tamper-evident audit logging.
No method of transmission or storage is completely secure. We cannot guarantee that unauthorized access, hardware failure, software bugs, or other factors will never compromise information. Customers must also protect credentials, endpoints, and identity providers under their control.
7. Security Incidents
If we confirm a Security Incident affecting Personal Data or Customer Data we process, we will investigate, contain, and notify the customer organization without undue delay and no later than 72 hours after confirmation, consistent with applicable law and our DPA (including assisting customers with their own notification obligations where required).
Individuals who believe their account has been compromised should contact their organization's administrator and security@traceunified.com. Vulnerability reports may be submitted to security@traceunified.com per our published vulnerability disclosure practice.
Incident notification describes known facts and remediation steps; it is not an admission of liability. Remedies related to incidents are governed by the Terms of Service, MSA, and DPA.
8. Retention
We retain information for as long as necessary to provide the Service and to meet legal, regulatory, security, and contractual obligations. Audit and compliance records may be retained according to the customer's configured retention policies and applicable regulated-record requirements.
Upon termination of the Service, Customer Data is returned or deleted in accordance with the MSA and DPA, subject to legal holds and residual backup copies that are deleted on a rolling schedule.
9. Your Rights
Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or export Personal Data, or to object to certain processing, and to lodge a complaint with a supervisory authority.
Because most Personal Data in the Service is processed on behalf of your organization, please direct requests to your organization first. We will support customers in responding to verifiable requests as required by law and the DPA. Controller-side requests regarding our own business contacts may be sent to privacy@traceunified.com.
California and similar U.S. state privacy laws: we do not sell or share Personal Data for cross-context behavioral advertising. We process Personal Data as a service provider/processor for customer content. To exercise applicable rights, contact your organization or privacy@traceunified.com.
10. International Data Transfers
Primary hosting and processing currently occur in the United States (AWS us-east-1). Where Personal Data is transferred from other regions, we rely on appropriate safeguards recognized under applicable law (such as standard contractual clauses or successor mechanisms) as described in the DPA.
Customers are responsible for assessing whether U.S. processing is appropriate for their data and for configuring their use of the Service accordingly.
11. Cookies and Similar Technologies
The Service uses cookies and similar technologies that are necessary for authentication, session management, security, and remembering preferences. We do not use third-party advertising cookies in the product application. Browser settings may block some cookies, which can prevent sign-in or certain features from working.
The marketing website may use essential cookies and similar technologies for security (including bot protection on forms) and to remember preferences. We do not use third-party advertising cookies on this website.
12. Children
The Service is not directed to children under 16 (or the applicable age of digital consent), and we do not knowingly collect Personal Data from children. If you believe a child has provided Personal Data, contact privacy@traceunified.com and we will take appropriate steps to delete it.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or to the customer's administrator, and the effective date above will be revised. Continued use after the effective date constitutes acknowledgment of the updated Policy, except where applicable law requires additional consent.
14. Contact
Privacy questions and data-protection inquiries: privacy@traceunified.com. Security incidents and vulnerability reports: security@traceunified.com. Legal: legal@traceunified.com. Website: https://traceunified.com.