1. Purpose
Trace builds and operates an AI platform that banks and other financial institutions use to automate their operations. Our clients trust us with their data and rely on our service to run their processes. This policy sets out how Trace protects the confidentiality, integrity and availability of that information, and of its own, and commits Trace's management to doing so.
2. Scope
This policy applies to everyone who works for Trace — founders, staff and contractors — and to all information Trace handles, the Trace platform, the systems and cloud services it runs on, the devices used to access them and the suppliers that support them.
Trace operates an information security management system (ISMS) that meets ISO/IEC 27001:2022 and the requirements of Regulation (EU) 2022/2554 (DORA) that apply to ICT third-party service providers of financial entities.
3. Commitments of management
Trace's management commits to:
- Meet requirements — the legal, regulatory and contractual requirements that apply to Trace and its clients, including GDPR, DORA and the security obligations agreed with each client.
- Manage risk — identify and assess information security risks regularly and treat them in proportion to their impact on Trace and its clients.
- Provide resources — give the ISMS the people, time, tools and budget it needs.
- Improve continually — measure how well the ISMS works, learn from incidents, audits and tests, and improve the controls and this policy.
4. Principles
- Client data first. Client data is used only to provide the service the client asked for, stays in the client's own workspace, is never used for any other purpose and is returned or deleted as agreed.
- Least privilege. People and systems get only the access they need, through personal accounts with multi-factor authentication; access is reviewed at least quarterly.
- Secure by design. Security is considered from the start of every project and change; code reaches the platform only through pull requests that pass automated security checks.
- Protection at every layer. Information is encrypted in transit and at rest; company devices are managed, encrypted and protected against malware; systems are kept up to date.
- Trusted suppliers. Suppliers that handle Trace or client information are assessed before use and reviewed every year.
- Prepared for incidents. Incidents are reported at once, handled under a tested plan and notified to clients and authorities as required.
- Resilient service. Data is backed up and restorable, and recovery is planned and tested so the service can be restored within agreed times.
- Aware people. Everyone receives security training when they join and every year.
5. Objectives
Trace sets measurable information security objectives each year, tracks them quarterly through its management system indicators and reviews them at the management review. The objectives include:
- all company devices managed, encrypted and protected against malware;
- multi-factor authentication on every account with access to Trace or client information;
- vulnerabilities fixed within the target times set for their severity;
- no serious information security incident, and every incident handled within the plan;
- backups restored successfully in the yearly test, within the target recovery time;
- every critical supplier assessed every year;
- ISO/IEC 27001 certification obtained and maintained.
6. Roles and responsibilities
| Role | Responsibility |
|---|---|
| Management (founders; CEO approves) | Approves this policy and the objectives, provides resources, reviews the ISMS at least yearly |
| CTO — ISMS manager | Runs the ISMS, the security controls and the risk assessment; leads incident response; reports to management |
| CPO | Owns privacy and data protection, and client-facing security commitments |
| Everyone working for Trace | Follows this policy and the policies below, protects the information they handle, and reports incidents and weaknesses at once |
7. Supporting policies and procedures
This policy is supported by topic-specific policies and procedures, including: access control and access reviews, cryptography and key management, data classification and handling, secure development, vulnerability management, logging and monitoring, backup and restore, business continuity and disaster recovery, incident response, supplier management, asset management and secure disposal, retention of information, and human resources security.
8. Compliance
Compliance with this policy is checked through internal audits, reviews and the management system indicators. A breach of this policy may lead to disciplinary measures under Trace's disciplinary procedure or to the termination of a contract.
9. Review and communication
This policy is reviewed at least once a year and whenever a significant change in the business, technology, risks or requirements makes it necessary. It is communicated to everyone working for Trace when they join and after each change, and is published for clients and other interested parties on this page.