Security & trust

Architecture

TracBrand is a multi-tenant platform. Every record — brands, assets, documents, cases, notices, threat findings and audit entries — belongs to exactly one organisation, and that boundary is applied at the data access layer on every query rather than being enforced in the interface. A request carrying one organisation’s identity cannot read another organisation’s data even if it references a valid identifier.

Authentication and access

• Passwords are hashed with bcrypt. We never store or transmit plaintext passwords, and we cannot recover a password on your behalf.
• Sessions use signed, expiring bearer tokens rather than long-lived server-side sessions. Tokens carry the user, organisation and role, and expire on a fixed window.
• Roles — five role types separate administration, brand ownership, legal approval, analysis and read-only access. Notice approval is a restricted action.
• Audit logging — authentication events, brand changes, case decisions, escalations, notice approvals and settings changes are written to an audit trail available to administrators in your organisation.

Data protection

• In transit — all traffic to the platform and to our website is served over TLS.
• At rest — customer data is stored in a managed PostgreSQL database with encryption at rest enabled at the infrastructure layer.
• Uploads — logos and IP documents you upload are retained for the life of the brand record and deleted on request or on termination.
• Secrets — credentials for external data sources and the AI provider are held as environment configuration, never in source control, and are not exposed to the browser.

Third parties

Detection depends on external data sources, and document and image analysis depends on an AI model provider. Material submitted for analysis is sent to that provider for the purpose of producing a verdict. We can supply a current subprocessor list, including the AI provider and its data handling terms, to customers and to prospects under evaluation — email security@tracbrand.com.

What we do not have yet

We would rather tell you this here than have it surface halfway through a security review.

• No SOC 2 or ISO 27001 certification. We do not hold either, and we will not imply otherwise. If a certification is a hard procurement requirement today, we are not the right fit yet — tell us and we will say so directly.
• No SAML or SSO. Authentication is email and password with role-based access. SSO is on the roadmap and not shipped.
• No customer-managed encryption keys and no region-pinned data residency options at present.
• No published penetration test report. We are happy to discuss our current testing practices under NDA rather than overstate them.

If any of the above changes, this page changes with it. Nothing gets claimed here before it is true.

Reporting a vulnerability

If you believe you have found a security issue, email security@tracbrand.com with enough detail to reproduce it. We will acknowledge within three business days and keep you updated until it is resolved.

Please do not run automated scanning against production, do not access or modify data belonging to others, and give us a reasonable window to remediate before disclosing publicly. We will not pursue legal action against researchers who follow these principles in good faith.

Questions from a security review

Send the questionnaire to security@tracbrand.com and we will complete it. If an answer is “not yet”, it will say “not yet”.