Security is foundational to an authentication platform. This page describes the technical and organisational measures we use to protect data on Traciqo, and is written to be accurate about where we are today.
Each business customer is provisioned a separate, isolated workspace with its own database. Customer data is not commingled across tenants, and logins are scoped so that one tenant cannot access another's data or the platform's administrative master site.
Payments are processed by Stripe. Traciqo does not store full payment card numbers; card data is handled by Stripe within their PCI-DSS-compliant environment.
The platform records scan events with device fingerprints, approximate geolocation, and anomaly signals. When a single code appears across many locations or devices in a way that suggests cloning, the system can flag the scan as anomalous — helping brands detect potential counterfeiting.
Traciqo is hosted on Oracle Cloud Infrastructure. Infrastructure and network controls are managed in line with cloud security best practices.
Our handling of personal data, sub-processors, international transfers, and data-subject rights is described in our Privacy Policy. We support data access, correction, and deletion requests as required by the UK GDPR and Data Protection Act 2018.
If you believe you have found a security vulnerability, please report it responsibly to [email protected]. Please give us reasonable time to investigate and remediate before any public disclosure, and do not access or modify data that is not yours while testing.
We are continually strengthening our security program. Planned work includes formal SOC 2 Type II and ISO/IEC 27001 readiness assessments, expanded logging and monitoring, and a published sub-processor change-notification process. This page will be updated as milestones are reached.
Security and privacy enquiries: [email protected].