Security at Tracktile

Tracktile runs entirely on Amazon Web Services. We operate no data centres and no physical servers.

Our application runs on managed, serverless compute. There are no persistent application servers to patch, log into, or misconfigure — running workloads are replaced from an immutable image on every deployment. Infrastructure is defined as code and applied through an automated pipeline, so environments are reproducible and every change is reviewable.

In transit. All connections to Tracktile use TLS. Unencrypted access to storage and databases is refused at the infrastructure layer rather than discouraged by convention.

At rest. Our production database, application storage and secrets are encrypted using AWS-managed key infrastructure. Encryption keys rotate automatically on an annual cycle, and key material is non-exportable by design — it cannot be extracted by anyone, including us.

Our production database is not reachable from the internet. It runs on a private network with no inbound route from the public internet.

Administrative access to production requires a connection through our corporate VPN. This is enforced at the network layer, not by policy alone: a connection attempted from anywhere else is dropped before authentication is even attempted.

We review our complete firewall ruleset at least annually. The overwhelming majority of production network rules permit no inbound traffic at all, and only the public-facing entry point that serves the application accepts traffic from the internet.

Access to Tracktile's internal systems is federated through a single identity provider with multi-factor authentication enforced. Our source control platform independently requires two-factor authentication of every member.

We apply least privilege. Access is granted by role, reviewed periodically, and removed when someone leaves or changes role. Administrative privileges in our cloud environment are held by a minimal number of named individuals.

Customer data is isolated at the database layer using row-level security, in addition to explicit tenant scoping in every application query. Isolation is enforced by the database itself, not solely by application logic.

Every code change reaches production through the same pipeline, and no step can be skipped:

• All changes are made via merge request. Direct pushes to protected branches are blocked and force-pushing is disabled.
• Every merge request requires approval from a designated code owner, and authors cannot approve their own work.
• Automated testing, linting and type checking must pass before merge.
• Creating a production release is restricted to a small set of senior engineers, and production deployments are started deliberately rather than automatically.

Application dependencies are scanned on every pipeline run. Container images are scanned automatically when pushed to our registry, covering the operating-system packages inside the image as well as the code we write. Findings are triaged by severity, and we target remediation of high-severity findings within 30 days of detection.

Where a vulnerability has no available fix, we record a documented reachability assessment explaining why it does not affect our service, rather than leaving it untracked.

We commission third-party penetration testing of our web application. Findings are tracked to remediation.

Application and infrastructure logs are centralised and retained for 365 days. Automated alarms watch the health of every production component and fire when a threshold is breached. Application exceptions are captured separately, and external uptime checks run against the production application and API.

Our production database is replicated synchronously across multiple availability zones, so that the failure of one does not take the service offline. Backups are automated and encrypted.

Tracktile is undergoing a SOC 2 Type II examination. Our security program is managed in Vanta, which continuously monitors our infrastructure and controls.

If you believe you have found a security vulnerability in Tracktile, please contact security@tracktile.io. We will acknowledge your report and keep you informed as we investigate. We ask that you give us a reasonable opportunity to address the issue before disclosing it publicly.