Security dossier

Trust is a system of controls.

How agent telemetry is isolated, encrypted, governed and investigated, with the limits stated as plainly as the strengths.

Email securitySee live status
TLS 1.3
In transit
AES-256
At rest
72 h
Breach notice
Ireland
EU region storage

Control families / 7

Seven boundaries. Pick one.

Encryption

TLS 1.3 in transit and AES-256 at rest.

  • API keys are hashed before storage.
  • Plaintext project keys are shown once.

Try it / runs in your browser

Paste a secret. Watch it vanish.

This is the same redaction rule set Tracify applies to inputs and outputs. Edit the text on the left. Nothing you type leaves this page.

What your agent sees
What Tracify stores5 values removed
Customer [REDACTED_EMAIL] called from [REDACTED_PHONE].
Card on file: [REDACTED_PHONE], SSN [REDACTED_PHONE].
Agent used [REDACTED_API_KEY] to refund.

Where a span goes

Follow one span through the system.

Four hops, each with a named job. The US queue hop is real, so it is on the diagram.

  1. 01

    Your agent

    The SDK or OTLP exporter sends spans with a project key. Plaintext keys are shown once and stored hashed.

  2. 02

    Redaction

    Email, phone, card, SSN and API-key patterns are removed before queued events leave the EU region.

  3. 03

    Queue

    Inngest Cloud processes queued span events in the United States, which is why we do not claim end-to-end EU residency.

  4. 04

    Storage

    Convex, Tinybird and Redis for the EU region are hosted in Ireland, scoped to the project that owns the key.

Plain limits

What we will not claim.

01

No end-to-end EU residency

Storage is in Ireland, but queued span events pass through Inngest in the US. We say so instead of rounding up.

02

No silent behavior changes

Runtime policies are observe-first. Cost ceilings are checked server-side and fail open, so monitoring never quietly breaks production traffic.

03

No keys in plaintext

Project keys are shown once at creation. After that only the hash exists on our side.

Questions

Security questions, answered plainly.

Where is Tracify data stored?

EU region accounts, traces and cache are stored in Ireland. Queued span events pass through Inngest in the United States, so Tracify does not claim end-to-end EU residency.

Are prompts and personal data redacted?

Email, phone, card, SSN and API-key patterns are redacted before queued events leave the EU region.

How are API keys protected?

Project keys are shown once at creation and only a hash is stored on our side.

Can one project see another project's traces?

No. Telemetry is scoped to the project derived from the authenticated key, and there is no cross-project query path.

Will Tracify slow down or break my production agent?

Runtime policies are observe-first and cost ceilings fail open, so monitoring does not silently change or block production traffic.

Found something? Tell us first.

Responsible disclosure goes straight to the people who can fix it. Affected users are notified within 72 hours.

Email securityOther questions