Trace the data, name the operators and agree the evidence your team needs before introducing customer code. Use this page as the starting point for a deployment-specific security review.
The application, database and model can have different operators. Your selected deployment route determines where these flows run. Integration and model settings determine what leaves that environment.
A connected repository, uploaded source archive or imported security report enters the application environment selected for your deployment.
Approve repositories, revisions, report contents and integration permissions.
AI workflows send selected source, report or finding context to the configured model endpoint. Responses return to the application.
Name the endpoint operator, processing location and applicable provider terms.
The installation holds findings, review decisions and associated evidence. Source workspaces, reports and operational records also need a lifecycle.
Set access, retention and deletion rules for each record type.
Enabled workflows can send findings or evidence to your configured issue tracker, SCM, report destination or audit sink.
Review each destination, transmitted fields, credentials and downstream retention.
With a hosted model, analysis context crosses to that endpoint even when the application and database are on-premises. A customer API key changes the provider account; it does not make the deployment air-gapped. A fully local model still needs a separate review of integrations, updates and licensing.
Product retention periods and deletion procedures depend on the deployment configuration and applicable agreement. This page does not specify a universal product retention window. Complete these decisions before customer data is onboarded.
Repository checkouts, uploaded archives and temporary analysis files.
Which source is copied, where it is held, when workspaces are cleaned up and what happens when a project is removed.
Imported reports, analysis results, finding evidence and remediation records.
Retention by record type, authorized export, deletion scope and the treatment of evidence linked across records.
Context sent for inference and the response; any separate records held by the model operator.
Provider logging, retention and training-use terms, processing location and whether those settings can be configured for your account.
Recorded user and system actions, application logs and configured external audit exports.
Recorded fields, access, retention, verification coverage and the lifecycle of copies in a SIEM or other sink.
Backups, exported files and records created in connected systems.
Backup expiry and restore handling, deletion ownership and how copies outside TraceMint are covered.
Connect your identity provider, scope who can act on projects and retain evidence for review. These are configured controls—not a substitute for validating your installation.
Configure OIDC or SAML single sign-on, map identity-provider groups to roles and manage project access. Supported SCIM user endpoints can provision and deactivate SCIM-managed users; SCIM Groups and every optional IdP feature are not implied.
Review the audit history and export CSV, JSONL or CEF records for downstream investigation. SIEM delivery requires a configured sink; audit integrity applies to the recorded verification boundary, not an unverified historical period.
Review project access and administrative roles in the actual installation. A marketing demo form never creates a tenant, grants access or authorizes a scan.
Source evidence, a model’s assessment, an operator decision and an independently reproduced outcome are different. Ask to inspect the evidence behind the status.
Recorded decisions and integrity verification have a defined boundary. Review the installation’s audit configuration and historical coverage; do not infer a certification or a retrospective integrity guarantee.
Use these items to define the documentation and evidence needed for approval.
Plan the evaluationApplication and database operator, model endpoint, processing locations, transmitted context, retention and deletion procedures.
Identity configuration, project roles, support access, upgrades, monitoring, backup and recovery, and incident contacts.
Required data-processing terms, model-provider terms, subprocessor information and any available assurance evidence. Confirm their scope and applicability.
Approved inputs, success criteria, observed results, unresolved limitations and the decision to proceed, change scope or stop.
Certifications, contractual service levels, support commitments and dedicated isolation require separate confirmation; they are not established by this website.
Contact the team privately with a short description and affected component. Please do not include live credentials, customer data or destructive payloads in your first message.
Contact securityWe will coordinate a suitable channel for sensitive evidence. This page does not grant authorization to test third-party systems or customer environments.
Tell us what you want to evaluate. Our team will review your request and contact you to agree the scope and arrange a time.
Request a demo