Compliance & Security

We believe security claims should be verifiable. The sections below describe our target architecture and the controls we implement as we scale. Specific metrics, retention windows, and SLA figures are contractual only where stated in a signed agreement.

For the current, verified status of any control or certification — including whether a particular assessment has been completed — please contact security@traiq-tech.com. We would rather tell you exactly where we are than overstate our maturity.

Traiq Tech's security infrastructure is built on a defense-in-depth architecture designed to protect the confidentiality, integrity, and availability of enterprise customer data at every layer. Our infrastructure runs exclusively on Amazon Web Services (AWS) using purpose-built Virtual Private Clouds (VPCs) with strict network segmentation, private subnets for all data-tier services, and no direct public internet access to databases or internal microservices.

Network security controls include AWS Security Groups and Network ACLs enforcing deny-by-default traffic policies, AWS Web Application Firewall (WAF) with managed rule sets for OWASP Top 10 protections and DDoS mitigation, AWS Shield Standard for volumetric DDoS protection (with Shield Advanced for production environments), and AWS GuardDuty for continuous threat detection and anomalous behavior monitoring.

All production deployments use Infrastructure as Code (IaC) via Terraform with mandatory peer review and automated policy compliance checks (using Terraform Sentinel) before any infrastructure change is applied. Production environments are fully immutable — changes are made by deploying new instances, never by modifying running infrastructure. This eliminates configuration drift and ensures reproducible, auditable infrastructure state.

As we scale, Traiq Tech is building a dedicated security engineering function responsible for threat modeling new features, reviewing security-relevant code changes, managing vulnerability disclosure, overseeing penetration testing, and maintaining our incident response capability. Our security program is designed around the NIST Cybersecurity Framework (CSF), with formal periodic security reviews on our roadmap.

All data at rest within the Traiq Tech platform is encrypted using AES-256. Encryption is applied at the storage layer (AWS EBS and S3 server-side encryption), the database layer (AWS RDS encryption-at-rest with dedicated KMS CMKs), and the application layer for particularly sensitive fields (such as PII fields and credential stores) using application-level encryption with separate key hierarchies.

Encryption keys are managed through AWS Key Management Service (KMS) with Hardware Security Module (HSM) backing. Each customer tenant uses a dedicated Customer Master Key (CMK), ensuring complete cryptographic isolation between tenants. Key rotation is automated on an annual basis at minimum, and manual rotation is performed following any security incident that could have exposed key material. Key access is logged, and key usage outside normal patterns triggers immediate security alerts.

All data in transit between clients and Traiq Tech services is encrypted using TLS 1.2 at minimum; TLS 1.3 is supported and preferred. We enforce HTTPS-only access with HSTS headers (including preloading), disable weak cipher suites and deprecated TLS versions (TLS 1.0 and 1.1 are not supported), and target an A+ rating on Qualys SSL Labs for public-facing endpoints. Internal service-to-service communication within the platform is designed to use mutual TLS (mTLS) with certificate rotation.

Backups are encrypted with separate encryption key hierarchies from primary storage. Backup encryption keys are stored in a separate AWS account with independent access controls, ensuring that compromise of the primary production account does not expose backup data. Database dumps used for cross-region replication are encrypted before transit and decrypted only in the destination region under destination-specific keys.

Traiq Tech implements an Identity and Access Management (IAM) framework based on the principle of least privilege. Customer-facing access is governed by a flexible Role-Based Access Control (RBAC) system with a granular permission model that enterprise administrators can assemble into custom roles tailored to their organizational structure. Pre-built roles (Administrator, Manager, Analyst, Read-Only, Module-specific roles) are provided as sensible starting points.

Multi-factor authentication (MFA) is mandatory for all Traiq Tech internal employees accessing production systems and is enforced via hardware security keys (FIDO2/WebAuthn) for privileged roles. Enterprise customers can enforce MFA for all their end-users via the admin console; MFA enforcement is mandatory for all Enterprise tier subscribers. Supported MFA methods include TOTP authenticator apps, SMS (not recommended for high-security environments), and FIDO2 hardware keys.

Single Sign-On (SSO) integration is available via SAML 2.0 and OIDC for enterprise customers, enabling integration with Microsoft Azure AD, Google Workspace, Okta, OneLogin, and other identity providers. SSO enables centralized access management and immediate access revocation from the Customer's identity provider. For customers with Zero Trust Network Access (ZTNA) requirements, Traiq Tech supports integration with Cloudflare Access and similar ZTNA solutions.

Internal employee access to production systems requires dual-authorization for privileged operations. All production access attempts are logged with user, timestamp, source IP, action taken, and resource accessed. Logs are immutable (written to append-only storage with cryptographic integrity verification), retained for 24 months, and are available to enterprise customers via the audit log export feature in the admin console.

Traiq Tech's platform is designed for a multi-region, multi-availability-zone cloud architecture targeting high availability and resilience. Target primary regions are AWS ap-south-1 (Mumbai, India) for South Asian deployments, AWS eu-west-1 (Dublin, Ireland) for European deployments, and AWS ap-southeast-1 (Singapore) for Southeast Asia and APAC deployments, with the specific regions enabled for a given customer confirmed in their Order Form. The architecture targets active-active operation across at least two availability zones, with cross-AZ load balancing and automatic failover.

The platform is architected as a distributed microservices system, with each service independently scalable, deployable, and fault-isolated. Services communicate via asynchronous event queues (AWS SQS and SNS) for resilience, with synchronous REST and gRPC APIs used only for latency-sensitive user-facing operations. Database connections use connection pooling (PgBouncer) to handle high concurrency without exhausting database connections.

Customer data is isolated at the database layer through a hybrid multi-tenant architecture: standard enterprise customers share database clusters with logical row-level tenant isolation and separate encryption keys; Enterprise Premier and Government tier customers receive dedicated database clusters for complete physical isolation. All database instances run in private subnets with no direct internet access, accessed only through application-tier service roles.

Traiq Tech maintains comprehensive, automated backup systems designed to protect against data loss from hardware failure, accidental deletion, software bugs, or security incidents. Automated daily snapshots are taken of all production databases using AWS RDS automated backups, with point-in-time recovery (PITR) enabled for continuous transaction log archival. This allows restoration to any second within the retention window.

Standard tier customers receive 30-day backup retention with daily snapshot granularity. Enterprise tier customers receive 90-day retention with PITR capability. Enterprise Premier customers receive 7-year archival storage for regulatory compliance requirements, with archived snapshots stored in S3 Glacier with expedited retrieval SLA. All backup configurations are visible to administrators in the Backup & Recovery section of the admin console.

Cross-region backup replication is performed for all production tenants to the nearest geographically diverse region (e.g., Mumbai production data is replicated to Singapore; Dublin to Frankfurt). Cross-region backups ensure that a regional AWS outage affecting the primary region does not result in data loss. Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) are defined in customer SLA Addenda: our standard SLA provides RTO of 4 hours and RPO of 1 hour.

Observability is central to Traiq Tech's operational reliability and security posture. Infrastructure and application metrics are designed to be collected using industry-standard observability tooling (such as Datadog), with dashboards for service health, latency percentiles, error rates, database performance, and infrastructure utilization. Alerting rules are tuned to minimize false positives while aiming for reliable detection of production anomalies.

Security-relevant events are collected into a centralized SIEM (Security Information and Event Management) system. Log sources include: AWS CloudTrail (all API calls); VPC Flow Logs (network traffic); application audit logs (user actions, access attempts, data operations); authentication logs (login attempts, MFA events, SSO assertions); and WAF logs (blocked requests, rule matches). Logs are normalized, correlated, and analyzed for indicators of compromise (IoCs) using automated detection rules.

All logs are written to immutable storage (S3 with Object Lock) to ensure their integrity for security investigations and regulatory audits. Security logs are retained for 12 months in hot storage and 24 months in cold archival storage. Customer-facing audit logs (recording end-user actions within the enterprise platform) are retained per the customer's configured retention policy and are available for export in JSON and CSV formats via the admin console.

Uptime monitoring via external synthetic checks, a public status page, and historical availability reporting are part of our operational roadmap. Once live, enterprise customers will be able to subscribe to automated status notifications via email, webhook, or PagerDuty integration.

Traiq Tech's compliance program is designed to support customers operating in regulated industries and jurisdictions. Our security controls are designed in alignment with multiple internationally recognized standards and frameworks, enabling enterprise customers to satisfy their own compliance obligations when using Traiq Tech.

Our primary compliance framework alignments include: ISO 27001 (Information Security Management — our controls are designed to align with ISO 27001 Annex A controls; formal certification is on our roadmap, not yet obtained); SOC 2 (we are adopting the AICPA Trust Services Criteria for security, availability, processing integrity, confidentiality, and privacy as our operational control framework; an independent Type II examination is planned, not yet completed); GDPR and UK GDPR; India's Digital Personal Data Protection Act 2023 (DPDPA); HIPAA-aligned technical safeguards for healthcare ERP deployments; and FERPA-aligned data handling for education deployments.

For sector-specific deployments (healthcare, education, government), Traiq Tech provides compliance configuration guides and technical addenda documenting the specific controls and configuration settings that support Customer compliance. These addenda are provided at contract signature and updated when platform changes affect the compliance posture.

Traiq Tech targets 99.9% uptime for the core platform SLA (Standard tier) and 99.95% for Enterprise tier customers. Actual historical uptime is published on our public status page. SLA credits are issued automatically when uptime commitments are missed, as defined in the SLA Addendum. Enterprise Premier customers may negotiate 99.99% SLA commitments with dedicated infrastructure configurations.

Platform resilience will be validated through chaos engineering exercises (for example, using AWS Fault Injection Simulator) that simulate availability zone failures, network latency spikes, database failover events, and service-to-service communication failures. Results feed into reliability improvement roadmaps. The platform is architected with the goal of maintaining availability through single-AZ outages in production regions.

Deployment reliability is maintained through progressive delivery practices: all production deployments use canary releases (1% → 5% → 25% → 100% traffic progression with automated rollback on error rate anomaly), blue-green deployments for major releases, and feature flags for controlled rollout of new capabilities. No production deployment can affect all customer traffic simultaneously.

Traiq Tech maintains a formal Incident Response Plan (IRP) that defines classification levels, escalation paths, communication protocols, and resolution procedures for security and availability incidents. The IRP is reviewed annually and following any significant incident. All engineering, security, and leadership staff receive incident response training.

Security incidents are classified on a four-level severity scale: P1 (Critical — active breach or confirmed data exposure, all hands, 15-minute initial response target); P2 (High — significant vulnerability or service degradation, 1-hour response target); P3 (Medium — limited impact, 4-hour response target); P4 (Low — informational, 24-hour response target). Incident status and updates are communicated to affected enterprise customers in real time via the admin console and designated security contacts.

Post-incident reviews (PIRs) are completed for all P1 and P2 incidents within 5 business days of resolution. PIRs include a timeline of events, root cause analysis, impact assessment, and concrete remediation and prevention actions with owners and due dates. Anonymized PIR summaries for significant incidents are shared with enterprise customers to maintain transparency and support their own risk management processes.

Enterprise customers receive a dedicated Security Review at onboarding, covering their specific deployment architecture, integration patterns, data flows, user access model, and regulatory requirements. This review results in a customized Security Configuration Checklist that guides the Customer's security team through optimal platform configuration for their environment.

Enterprise plans are designed to include regular security touchpoints, such as: periodic security briefings (updates on platform security improvements, new threats, and recommended configuration changes); security review meetings (review of security posture, any audit findings, and roadmap); and access to Traiq Tech's security contact for security questions or concerns outside of standard support workflows. The specific cadence is set out in the applicable enterprise agreement.

Traiq Tech participates in responsible disclosure with a public vulnerability disclosure program. Security researchers may report vulnerabilities to security@traiq-tech.com. We commit to acknowledging reports within 48 hours, providing a substantive assessment within 10 business days, and issuing CVE disclosures and patches within 90 days for confirmed vulnerabilities. We do not pursue legal action against good-faith security researchers operating within the scope of our disclosure program.

For government and regulated-industry customers, Traiq Tech can support Memoranda of Understanding (MoUs) and complete the security compliance questionnaires required by regulatory bodies. Our controls and documentation are designed to address common frameworks — including banking (RBI guidelines), healthcare (NABH, JCI), education (UGC), and central and state government procurement frameworks across India, Singapore, and the UAE.