Trust & Security

What we do to earn your trust — and what we don't claim.

Security practices

  • Multi-tenant isolation: every row carries tenant_id with Postgres Row Level Security.
  • API keys never stored raw: SHA-256 lookup + Argon2id verification; brute-force lockout.
  • Append-only audit (WORM triggers) and hash-chained e-signature trails for non-repudiation.
  • Privacy by design: IPs and user agents stored only as pseudonyms/hashes.
  • Errors follow RFC 7807 with correlation IDs — no stack traces, no enumeration.
  • Email authentication for sending: SPF/DKIM/DMARC on mg.traxmark.com; one-click unsubscribe (RFC 8058).

Compliance

GDPR: data controller is TriStiX S.L. (Alicante, España). Data residency: EU (Supabase Frankfurt region). Data subject requests: privacy@traxmark.com. (TriStiX S.L. · VAT UE: ES-B-PENDING · Alicante, España · privacy@traxmark.com)

SOC 2 Type II and ISO 27001 are on the roadmap; we will not claim certifications we don't hold.

Responsible disclosure

Found a vulnerability? Email security@traxmark.com (see /.well-known/security.txt). We coordinate fixes and won't pursue researchers acting in good faith. security@traxmark.com

https://traxmark.com/.well-known/security.txt

Platform status

Live component status and incident history: status page

Honest limitations

An open is an open signal, not proof of reading. Absence of signal ≠ unread. Bot/proxy classification is probabilistic and labeled with confidence.