Security Overview

1. Our approach

Security and privacy are core to TraIDCred. We design the Services so that sensitive documents stay private by default and are shown only to the people you authorize. This overview describes our current safeguards in plain language. No system is perfectly secure, and we do not claim otherwise.

2. Data protection

• Private document storage. Credential documents are stored in a private storage location that

is not publicly accessible. Public Profiles never expose document files, their contents, filenames, storage paths, reviewer notes, or Sensitive Credential Data.

• Encryption. Data is encrypted in transit (HTTPS/TLS) and at rest.
• Access controls. We enforce authorization at the database layer using row-level security, so users

can reach only the data they are permitted to. Internal access follows least-privilege principles, and elevated (service-role) access is narrowly scoped to specific server-side operations.

3. Controlled document access

When a Tradesperson (or the Services on their behalf) grants a Profile Viewer access to a specific document, that access is token-gated, time-limited, and revocable, and is served through short-lived signed links that expire. There is no anonymous access to stored documents.

4. Privacy by design

Our analytics are deliberately minimal: we record only a profile view and a QR scan, using a salted, per-day, one-way hash for de-duplication, and we do not store IP addresses, user-agent strings, device fingerprints, or advertising identifiers for analytics, and do not use cross-site tracking. (Limited technical metadata is recorded only with legal-acceptance records, as described in the Privacy Policy §2.3.)

5. Infrastructure and providers

The Services run on established cloud infrastructure. Our current sub-processors are Vercel (application hosting), Supabase (database, authentication, and storage), Cloudflare (encrypted off-site backup storage), Resend (transactional email), Google (business email — the mailboxes that receive messages you send to our published @traidcred.com addresses), Stripe (payment processing, and identity verification through Stripe Identity), and OpenAI (automated single-pass reading of submitted credential documents that produces suggested field values for our reviewers; documents are sent inline for the one reading, are not uploaded to OpenAI file storage, and API content is not used for model training by default), each under confidentiality and security obligations. Payment-card data is handled by Stripe; TraIDCred does not store full card numbers. Government ID and selfie images are collected and held by Stripe and are never received by TraIDCred (see the Identity Verification Notice). The Services are operated for users in the United States, and our primary application and database infrastructure is US-based.

5a. Backup and disaster recovery

We maintain an encrypted, private, off-site backup of the database and of uploaded files, held with Cloudflare and reachable only with a scoped credential held by TraIDCred operations personnel. It is never public, never served to any user, and used only to restore the Services after data loss.

• Database backups are point-in-time snapshots on a rolling cycle (approximately 14 daily and 8

weekly copies, about two months of history).

• Uploaded-file backups are append-only. A file deleted from live storage is kept in the backup

rather than removed, because a deletion caused by a defect or a mistake is exactly what a backup exists to reverse. See the Data Retention Policy §3.3, which states plainly what that means for a deletion request.

• Restores are rehearsed, not assumed. We run a quarterly disaster-recovery drill — restoring

from the real backup and verifying its integrity — and additionally before any migration that rewrites data. A backup-health check reports whether the most recent run succeeded and how fresh it is, warning past 24 hours and escalating past 48. A backup nobody has restored from is a hope rather than a control.

6. Responsible disclosure

If you believe you have found a security vulnerability, please email security@traidcred.com and give us a reasonable opportunity to respond before public disclosure (see the Acceptable Use Policy §6.2). We appreciate good-faith security research.

7. Honest limits and incident response

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a security incident affecting personal information, we will investigate and provide any notifications required by applicable law without undue delay.

8. Changes

We may update this overview as our practices evolve; it is versioned so you can see what changed.