Security & assurance,
built for scrutiny.
Trace Vantage is engineered with layered controls across identity, access, encryption, network boundaries and tamper-evident audit. Because the platform is installed inside the force environment, security is assured jointly: Trace Intel provides the controls and the evidence; the force operates them under its own policy, infrastructure and configuration.
This page describes how the platform is designed and how it is assured. It does not assert certifications or accreditations the platform has not obtained. Effective posture depends on the deployment configuration agreed with the force.
Every action tied to an authenticated identity.
Access is designed around least privilege. Users authenticate against force identity, permissions follow role, and sensitive functions carry additional controls. The platform is designed to integrate with the force's existing identity provider rather than create a parallel one.
Authentication
Session-based authentication with signed session tokens and a supervisor, commander and administrator hierarchy enforced in middleware on every request.
Role-based access control
Permissions are granted by role and case assignment. Users see and act only within the scope their role and current tasking allow.
Multi-factor authentication
Designed to support MFA and single sign-on through integration with the force identity provider (for example SAML or OIDC), subject to the deployment configuration.
Identity integration
Aligns to the force's existing directory and joiner, mover, leaver processes so account lifecycle stays under force control.
Encrypted in transit, encrypted at rest, controlled at the boundary.
Operational data stays within force-controlled infrastructure. Encryption keys, storage and network policy remain under force identity, so protection is applied by the organisation that owns the data.
In transit
Traffic is designed to be protected with current transport-layer encryption between clients, services and integrated systems, configured to force standards.
At rest
Stored data and evidence are designed for encryption at rest using keys held under force control. Trace Intel does not hold force keys.
Network controls
Deployable on-premises, in a private force cloud or air-gapped, behind force network segmentation, firewalls and egress control.
External connections are routed through a managed-egress boundary so outbound requests are policy-controlled and logged. Optional intelligence sources and AI services are connected only under force authorisation.
Tamper-evident by design, evidenced for reviewers.
Tamper-evident audit
Sensitive records are written to a hash-chained audit trail so later alteration is detectable. The platform records who acted, what changed, when, and under what authority.
Access & decision logging
Authentication, access, evidential actions and AI use are logged with field-level redaction in operational logs, supporting oversight and disclosure.
Assurance documentation
Deployment, configuration and control documentation is provided to support the force's information-assurance and accreditation process. The platform is designed to be assured, not sold as pre-accredited.
Aligned to recognised guidance
Control design is aligned to recognised security and secure-development guidance. Formal certification, where required, is a matter for the deployed configuration and the force's assurance authority.
Secure through the build and through the incident.
Security is treated as a lifecycle, not a launch state. Controls span how the platform is built, how weaknesses are managed, and how the force recovers if something goes wrong.
Secure development lifecycle
Development follows secure-coding practice with code review, dependency scanning, automated tests and a hardened content-security policy. Changes are checked before release.
Vulnerability management
Dependencies and components are monitored for known vulnerabilities, triaged by severity and addressed through maintained security updates under the optional assurance programme.
Incident response
The platform provides the logging and audit evidence needed to support the force's incident-response process. Roles and escalation paths are agreed with the force at deployment.
Backup & recovery
Scheduled backups with defined retention support recovery objectives. Backups reside within force-controlled infrastructure and are configured to force policy.
Independent penetration testing (roadmap)
The assurance roadmap includes independent penetration testing. This is stated as planned, not as a completed or certified outcome, and is scoped with the force.
Where security is provided, and where it is operated.
Because Trace Vantage runs inside the force environment, security is a shared responsibility. Trace Intel provides the platform controls and the evidence to assure them; the force operates them within its own infrastructure and policy. Some outcomes are jointly assured.
- Authentication, RBAC and audit built into the platform
- Encryption capability in transit and at rest
- Secure development, testing and dependency scanning
- Security updates under optional assurance
- Assurance and configuration documentation
- Infrastructure, network segmentation and firewalls
- Encryption keys, storage and retention policy
- Identity provider, MFA and account lifecycle
- Physical security and personnel vetting
- Local accreditation and information-assurance sign-off
- Deployment and hardening configuration
- Incident response roles and escalation
- Access-review and audit oversight cadence
- Penetration-test scope and remediation (roadmap)
- Backup, recovery and continuity objectives
The security outcome achieved in practice depends on the deployment configuration and the controls the force operates. Trace Intel does not represent the platform as certified or accredited on the force's behalf.
Report a vulnerability.
We welcome responsible disclosure from researchers and assurance teams. Report suspected vulnerabilities to security@traceintel.com and we will acknowledge and triage in line with our vulnerability-management process.
security@traceintel.com
Please include enough detail to reproduce the issue. Do not include live operational or case data in your report.
Bring your information-assurance team to the table.
Review the control set, the audit model and the shared-responsibility split against your own accreditation requirements.