Security overview

1. Tenant isolation

Every record carries an organization key, and matter access is authorized on every read. Cross-tenant retrieval is prevented by construction and covered by tests, so your content is never exposed to other Tracecanon customers or to other Nimavera products.

2. Data protection

Uploads are stored in private object storage and served only through short-lived signed URLs, never public links. Data is encrypted in transit (TLS), and secrets are encrypted at rest. Uploads are resumable and go straight to secure storage.

3. Authentication and access control

Authentication supports two-step verification (TOTP authenticator, emailed code or recovery code) — required for platform administrators — and server-side session revocation, with account protections against repeated failed logins. Within an organization, access is governed by roles and matter-level permissions.

The application admin console does not expose recordings or transcript text, so support staff have no standing application access to Customer Content. Exceptional infrastructure access is handled as a break-glass operation through restricted infrastructure credentials, time-limited approval, and infrastructure audit logging.

4. Malware scanning, untrusted uploads and AI safety

Every uploaded file — and every file extracted from an archive or attached to an email — is scanned for malware with ClamAV, running on our own processing servers with signatures updated throughout the day, before any worker opens it. No file is sent to a third-party scanning service. A file in which malware is found is quarantined: it is never processed or offered for download, you see the verdict, and you can delete it; both are recorded in the audit trail. If the scanner is unavailable, files wait unopened until it is back — they are never processed unscanned. Scanning reduces risk; no scanner detects everything.

Files are then validated by signature and container/codec inside isolated workers. Archives are unpacked without trusting their own paths or sizes (no path can escape the archive; inflated sizes, compression ratios, entry counts and nesting depth are bounded). Retrieval and analysis treat recovered content as data, never as instructions, as a defense against prompt injection embedded in transcripts or documents.

5. Auditability

Evidence handling, processing stages, model activity, access, review decisions, corrections, exports, sharing, and account changes are recorded in an ordered, append-only, hash-chained audit trail. The trail retains operational metadata and hashes, not evidence content, prompts, questions, answers, credentials, or model responses. Source hashes and upload manifests separately record provenance and processing history.

6. Resilience and backups

Background processing is durable and database-backed, using leases and retries so work survives restarts. We maintain backups and restore procedures, and failure boundaries are separated from unrelated products.

7. Sub-processor security and retention

Sub-processors are vetted and bound by data-processing agreements; the current list is on the Sub-processors page. Customer Content is retained per your plan and matter settings and deleted thereafter, subject to legal hold, as described in the Privacy Policy.

8. Breach notification and reporting

If we become aware of a personal-data breach affecting Customer Content, we will notify the affected organization without undue delay and assist with its obligations, as set out in the Privacy Policy and Data Processing Addendum.

No system is perfectly secure. If you believe you have found a vulnerability, report it to security@tracecanon.com and please do not access or modify data that is not yours.

• Security contact: security@tracecanon.com
• Privacy contact: privacy@tracecanon.com