The security posture, stated in prose.
A procurement reviewer should be able to read this page once and decide whether to forward it to legal. No compliance-logo wall. No shield icons. No "trust center" framing. The five sections below cover what a security questionnaire asks first.
Certifications
Traceo holds no SOC 2 report, ISO 27001 certificate, or other third-party attestation today. We will not claim compliance we do not have. Procurement and security questionnaires are answered directly — email security@traceo.cat.
Hosting
The web application is served by Vercel. The API and its PostgreSQL database run on Railway. Every public surface is served over HTTPS. Self-hosting is not offered today.
Analytics
The product application ships no third-party analytics or tracking scripts.
Access controls
Sign-in is by email and password, Google, or GitHub. Each workspace member holds one of four roles — Owner, Admin, Editor, or Viewer.
Procurement reviewers and security teams: email security@traceo.cat.
Compliance posture.
Traceo is built for teams whose requirements will be audited. Every requirement link is typed, and every link type is encoded three ways — color, glyph, and label — so meaning never rests on color alone.
The state palette is checked in CI against WCAG 2.2 AA contrast. The traceability graph has a keyboard tree view over the same data, so the canvas is not the only road through it.
No third-party analytics or tracking scripts in the product application.
- Typed links
- Graph · matrix · tree
- MCP-native