Security

Built for the data agents actually send.

Agent traces carry prompts, completions, tool inputs and the identifiers of the people they served. This page is what we do about that, in the engine and in the cloud, stated so it can be checked.

Architecture

Three public hosts. The engines are on none of them.

api.trazadb.com

The gateway. It authenticates your API key, checks its scope against the route, rate-limits per project and forwards to your project’s cell with an engine credential bound to your tenant. Operator routes (admin, backups, flush, checkpoint, whole-store verify, metrics, the full ledger, erasure) answer 404 here, always.

app.trazadb.com

The console and its API. Session cookies are __Host- prefixed, HttpOnly, Secure and SameSite=Lax, stored server-side only as a SHA-256. Every mutating request must come from the console’s own origin and carry a custom header. A strict CSP and frame-ancestors 'none' on every page. Single sign-on is scoped to its organization: an org’s identity provider signs people in only on email domains the org has proven in DNS, never into an existing account its owner has not linked, and only into that organization.

trazadb.com

This site: static files, no cookies, no forms that collect anything, and no third-party scripts.

Cells run the open traza-server on a private network, reachable only from the control plane. Each project is its own engine tenant, and project traffic uses credentials bound to that tenant, so even a bug in the gateway cannot read across tenants: the engine applies the binding where it builds every query.

Data handling

What we store, and how.

Secrets we issue are stored as hashes. API keys (200 random bits, shown once), session tokens, sign-in links, invites and share links are kept as SHA-256 only.
Secrets we must use are sealed. Engine credentials, alert destination settings, OIDC client secrets and the notary’s private key are encrypted with AES-256-GCM under a master key that lives outside the database.
TLS on every public host. Outbound calls to Stripe, GitHub, email, Slack and your webhooks use TLS with timeouts; webhook and Slack destinations must be HTTPS and may not point at private or loopback addresses.
Retention is enforced by the engine. Your plan’s retention is set as your tenant’s TTL; spans past it expire. Deleting a project erases its tenant on its cell and keeps the erasure receipt.
No training, no resale. Your traces are yours: stored to serve your queries, replays and exports, and nothing else.

The engine

A small surface, on purpose.

Everything below is in the open source, where you can check it.

#![forbid(unsafe_code)]. The engine crate permits no unsafe code, so any memory-safety break would be a compiler or standard-library bug, and is in scope for a report.
A dependency budget. Three direct dependencies in a default build: serde, serde_json and lz4_flex, the last with its safe implementations selected. HTTP, the OTLP decoder, the write-ahead log and SHA-256 are the standard library. A new dependency needs a written case. The budget and its rejections.
The MCP boundary. Stored span text is attacker-controlled by assumption. On the MCP surface it stays inside blocks marked untrusted and never reaches a tool description or an error message; the server holds no fetcher, no shell and no outbound network path; there is no replay tool, so stored telemetry cannot choose what a model is fed next. How content is confined.
Scopes enforced where queries are built. A tenant-bound credential reads and writes only its tenant on every surface: search, export, tail, analytics, payloads, evals, erasure, usage and MCP.
Durability you can see. Every write acknowledgement states which durability mode answered it, and the test suite proves the modes by killing the process.

The notary key

A public key you can pin.

Traza Cloud’s notary signs ledger anchors and evidence attestations with Ed25519. Its public keys, current and retired, are published with their ids; its transparency log is public and hash-chained, and carries store ids, ledger heads and signatures, never tenant data.

Keys app.trazadb.com/.well-known/traza-notary.json
Log app.trazadb.com/notary/log
Authority notary.trazadb.com
Verify a signature with OpenSSL 3 and the recipe in the Prove docs.

Disclosure

Report a vulnerability.

Report suspected vulnerabilities in the engine or in Traza Cloud privately, through GitHub’s private vulnerability reporting on the engine repository. You will get an acknowledgement within 72 hours. Please do not open a public issue.

Report privately on GitHub SECURITY.md

In scope: anything that breaks the untrusted-content confinement, the auth gate or scope enforcement, crosses a tenant, breaks the documented durability contract, or bypasses the gateway or console controls above. A machine-readable contact is at /.well-known/security.txt.