Your compliance data is your business. Period.

Account details: your name, email address, phone number if you provide one, and your password (stored only in a scrambled form we can't read).

If you use Import your files, TRACE also keeps a log of each run: the name of the folder you chose, who ran it and when, and for each file you chose to import its path inside that folder, its name and size, where it was filed, the person it was filed under, what TRACE took it for and why, a few details read from it (a document number, a revision, a date, a method, a certification level), and whether someone has since confirmed it. The log does not keep the text of your files. The folder is read in your browser, and nothing leaves your computer until you press Import. Files you import are stored like any other uploaded document, restricted to your firm's consultants until you release them.

The compliance data you enter: companies, contacts, technicians, certifications, compliance items, tasks, comments, and the documents you upload — plus whatever the modules you've switched on hold, which can include safety and radiation records, personnel and HR records, equipment and calibration checks, quality-system records, projects, and invoicing. For the vendors your firm pays, that can include whether they get a 1099 from you and whether their W-9 is on file — and at most the last four digits of a tax ID, never the full Social Security or Employer Identification Number, which the vendor record will not store. This is your data — TRACE stores and organizes it so you can run your business, and that's the only thing it's used for.

Comments on your records. Wherever your team used to write an internal note, it now writes in a thread on the record — on a company, a technician, a certification, a document, a task, a deal, an estimate, an invoice, a board card, and on the expenses, purchase orders, vendors and recurring invoices in Ledger. What goes in one is whatever your staff type, kept with the name of whoever wrote it and when. These are for your own staff and nobody else: no client login and no technician login can read a thread, on any record, including a record they can otherwise see — the database refuses the query rather than a page hiding it, and there is no client-facing version of a thread to misconfigure. Mentioning a colleague on a board card raises a notification for them inside TRACE and on their phone if they have the app; it sends no email, and what the notification shows is the first line or so of what you wrote.

Messages in your firm's chat. Chat lets the people of one firm — its consultants and the technicians who have logins — write to one another in channels and in direct messages. We keep what each message says (text up to 2,000 characters, with any web links in it), who wrote it by the name the chat shows, when it was sent and edited, and which people it mentioned; and, for each person, which conversations they are in, when they last read each one, and whether they muted it or asked for alerts. A message can be read only by the people in its conversation: everyone in the firm for a channel meant for everyone, the people picked for any other channel, and only the people in it for a direct message. Your clients never see chat, and TRACE staff cannot read it, not even while a support window is open. Your owner and office managers cannot read other people's direct messages; they can remove a message from a channel, and its author can edit it for 15 minutes or remove it at any time. The exception is a report: if someone in a conversation reports a message, a copy of that one message, with who wrote it, who reported it and the reason they gave, goes to your firm's owner and Office Administrators to review, and they can hide or remove it. If you block someone, we record that you did, so that their messages can be kept from you. A report and the decision on it are kept on the report itself, which only your owner and Office Administrators can open, and are not copied into your firm's change history; TRACE staff never see a report's contents. If a report is about the only person in your firm who could review it and is still open three days later, TRACE support is told that a report is waiting — your firm's name, when the report was made and the reason category picked, never the message, who wrote it, who reported it or the note — and your primary user is told it was passed on. A block is recorded in your firm's change history, where among your firm's people only your owner and Office Administrators can see it. Chat messages themselves are not copied into your firm's change history. A message that rings someone's bell carries its first 140 characters into that bell and, for a person with the TRACE app and notifications on, into the phone alert, which travels by way of Expo and Apple's or Google's notification service as described under "Expo". Your primary user can switch chat off for the whole firm from the Account page; it then disappears from the website and the phone app and nothing already written is deleted. Messages stay until someone removes them; a person who is deactivated keeps their name on what they wrote; and deleting your firm deletes its chat with it.

Your firm's own money records, if you use Ledger. The register holds the accounts you set up — what you call each one, whether it is a checking, savings or credit card account, the balance you opened it at, and the last four digits if you enter them. Four digits is all the database will take: it refuses anything longer, so a full account or card number cannot be stored, and there is nowhere to put a routing number. Importing a statement reads your file and keeps the lines from it — the date, the description your bank printed, which usually names who you paid or were paid by, the amount, and any reference on it — together with what each line was matched to and, where you set one aside as a transfer or as personal, the note you have to write saying why. The file you uploaded is not kept: it is read, the rows are written from it, and it goes. Receipts you capture are kept, filed as ordinary documents in the same private storage as everything else you upload; TRACE does not read the figures off the picture, so what is recorded is what you typed. All of this is your firm's own, and it stays there: no client login and no technician login can see any of it, and none of it is sent to an AI model.

Records of who did what. Some of what TRACE holds is deliberately about accountability rather than about a thing: which named person holds a company's appointments (the Radiation Safety Officer, the Quality Manager, the Responsible Level III), who signed a certification, who administered an exam, who changed a record and when, and who opened or downloaded a document and when. That is the point of a compliance record — it is worth knowing that TRACE keeps it, and that it is about identifiable people.

Posting rules. Before your first message in your firm's chat, or your first thread or reply in Community, you are asked to agree to the posting rules in section 7 of our Terms of Service. TRACE keeps that you agreed, which version of the rules, and when, against your login, and does not accept a post from you until you have. It is removed when your login is deleted.

Personnel records, if your firm uses the People module. That module keeps what an employer keeps: employment details and job title, onboarding and offboarding checklists, and the cards and licences that get someone through a gate — a government ID, a site access badge, a client's orientation, a medical clearance — with the number on the card and when it expires. It also records screenings and discipline. A screening notes only that a drug test, alcohol test, background check or physical happened, when, who carried it out, whether your firm concluded the person was cleared, and when the next one is due; there is nowhere in TRACE to put what was tested for, and no result, panel or report is held. A disciplinary record holds what your staff write into it — the kind, from a coaching note to a termination, the date, a summary, who issued it, and whether the person was shown it. Both are for your own staff with that module: no client login and no technician login can see either, including the technician the record is about. These are records about identifiable people, kept because you chose to keep them — the Terms say plainly that you decide what to collect, that you need a lawful basis for it, and that you set how long it stays.

Pay and leave records, if your firm uses them. A firm that has the People module or Project Management can keep, for each person, a payroll file number, whether they are paid overtime, their pay type (hourly or salary) and pay rate from a date, and a leave account of PTO and sick time. A change of pay is added as a new line with its date and reason and the earlier lines stay; nothing is overwritten or deleted. The leave account is a ledger: a starting balance, the hours earned from verified timesheet hours or pay periods, the hours taken when time off is approved, and adjustments, each with who made it and why. A firm can also set how often it pays and which payroll codes to use, and lock a pay period to export it, and TRACE then keeps the two files it made — hours by person and earnings code, with each person's payroll file number — so the same files can be shown again, with a note if hours change afterwards. Pay rates, pay-period settings and exports are seen only by the firm's owner, an Office Administrator and a People Manager; leave balances are also seen by a Projects Manager and by the person they belong to, who sees their own and never their pay or anyone else's. No client login and no other technician sees any of it, and TRACE staff cannot see it unless your firm opens a support window. The firm's change history shows the pay and leave lines only to the people who can read them on the person's own page. TRACE does not ask for a bank account number or a tax identifier for any of it, and does not connect to a payroll provider: the export is a file your firm uploads itself. A person's record cannot be deleted while a pay or leave history exists for it; deleting the firm's account deletes it all.

FAA mechanic certificates, if your firm tracks them. A firm that employs aircraft maintenance technicians can switch on A&P and Inspection Authorization tracking; it is off until someone on your firm's staff switches it on from the Certifications page, and switching it off again hides it without deleting anything. For each mechanic it keeps what the FAA's rules turn on: the certificate number if you enter one, whether it carries the airframe and powerplant ratings, when it was issued, the last day the person worked as a mechanic and the date of any FAA finding that they could do the work — or, if your firm ticks it for that person, the latest day they logged hours on a job — and, for an Inspection Authorization, its dates and each renewal activity (an annual inspection, a major repair, a refresher course and the like), with any certificate or other evidence you attach, filed as an ordinary document. The certificate number needs care: older FAA certificates were issued with the holder's Social Security number as the certificate number. So the field is optional, and the number is seen only by your firm's own staff and by the mechanic on their own record. A client company's portal shows the ratings, whether the certificate and any Inspection Authorization are current and the next date that matters — never the number, your notes or the activity detail — and the reminders on the bell, in the digest email and on the calendar name the mechanic and the date, never the number. Deleting the mechanic's record, or your firm's account, deletes all of it.

Photographs, if a test asks for them. A consultancy can set a test to use the camera: the candidate then takes one photo holding their ID before the questions appear, and a small still every few minutes while they work, all kept with the result for the examiner to review. It is off unless the consultancy switches it on for that test, and the browser asks the candidate's permission for the camera before any picture is taken. They are kept with the result, and deleting the consultancy's account deletes them.

The phone app's camera. The TRACE phone app asks for the camera for three things, and only when you open them. To scan a traveler, you point the phone at the QR code printed on a work order; the app reads the code on the phone itself and takes nothing but the traveler's reference from it, which it sends to TRACE to open that traveler for you. The camera picture is not recorded, saved or sent anywhere, and the app takes no video or sound. To photograph a receipt, certificate, field report or other record, you take a picture and choose to file it: that photograph is sent to TRACE and kept with the record you attach it to, like any other file you upload, or waits on the phone until it can be sent if there is no signal. To scan a business card, you photograph it and the photo is sent to TRACE, where, if your firm has AI on, Anthropic reads it to fill in a new contact for you to check; the photo is kept with that contact. If you say no to the camera, the rest of the app works.

Getting the app. The TRACE NDT app is downloaded from tracendt.com today, and its Google Play listing is in Google's review. Once it is on Google Play, installing it that way is between you and Google, under Google's own terms and privacy policy; TRACE does not receive your Google account or who installed the app from Play, and the app itself contains no advertising, analytics or crash-reporting service. Signing in to the app is with the login your firm or you already have on the website.

Training, if your firm uses it. A firm can write courses for its own people, assign them with a due date — by hand, as part of a path, or by a rule that hands a course to everyone who matches it — and keep the record when each person finishes. While someone works through a course, TRACE notes which sections they have opened and when, because a course can be signed only once every section has been read. If your firm uses Learning, TRACE also notes, for each lesson, when you last had it open and how long it has been open, and, for a video the firm hosts in TRACE, how much of it you have watched and the furthest point you reached, because a course can require a minimum time on a lesson or a share of a video watched. The firm sees this with the rest of your progress. A hosted video is kept in a private area of our storage provider, played to a signed-in person through a short-lived link, and deleted with the firm. Signing means typing your full name under the statement the firm wrote for that course; TRACE keeps the name you typed, that statement, the time, and which login signed. A course can also end with one of the firm's own tests, and then the record carries the score. Someone at the firm can ask one of its own people who has a TRACE login to countersign a record; TRACE keeps who was asked, by whom and when, and — once that person signs it themselves, with their own login — the name they typed, the time and which login signed. Nobody can countersign in someone else's name or their own record. Countersigns recorded before October 2026 are kept as they were, labelled as recorded by the office. A record made by signing a course or passing a test cannot be changed or removed by the firm's staff: taking the course again later makes a new record beside the old one. If the firm moves a course to another part of its work, the records of it move with it — who signed, what, and when stay exactly as they were — and the move is kept in the firm's audit log. These records are seen by the firm's own staff, by the person they are about on their own record — without the notes the firm's staff keep on it — and, where the firm shows a client company its quality, safety or HR records, by that company's portal logins, who see the course, the dates, the hours, the name signed and when, and the certificate code, but not the score, the notes or the reading history. The same goes for a person's authorizations and auditor qualifications: they see their own, but not the firm's notes on them, the reason one was withdrawn, or who evaluated them. If a client company the firm keeps moves to a workspace of its own, its people's training records, authorizations and auditor qualifications are copied into it, each signature kept as it was and marked as a copy; the firm keeps its own copy as history. If a client company moves to another firm, each of its people's training records that still counts (not one the firm withdrew) is copied to the new firm with the person's own signature, the hours, dates and method, and the name of the firm that recorded it — but not that firm's private notes on it — and the firm it came from keeps its own copy; the new firm cannot change or remove the copy. Deleting the person's record deletes all of it; deleting a firm's account deletes that firm's copies, not the other firm's. No AI feature reads any of it.

Training sessions, continuing-education targets and office staff, if your firm uses them. A firm can record training given in person as a session: what was taught, when and where, who taught it (one of its own people, or an outside instructor by name) and who was on the attendance sheet. For each person TRACE keeps whether they were marked present or absent, who marked it and when, and — if they sign that they attended — the name they typed, the time and which login signed. The instructor signs the sheet the same way, with their own login; an instructor with no login signs it themselves through a signing link, described below. (Sheets a firm signed on an outside instructor's behalf before October 2026 still record that it did and who signed.) Each person present gets a training record, as described above. The sheet is seen by the firm's own staff and by the instructor; a person on it sees that session and their own line, not anyone else's. A firm can also set continuing-education targets — hours per year or per certification cycle, for a person, everyone certified in a method, or everyone holding an appointment — and TRACE works out each person's progress from their training records; that progress is seen by the firm's own staff and by the person themselves. And a firm can put its own office staff on its training roster, which makes a training file for that person on the firm's own company, linked to their login. Deleting the person's record, the session, or the firm's account deletes all of it. No AI feature reads any of it.

Client onboarding links, if your firm sends one. A firm can make a private link for one of its client companies and have TRACE email it to an address the firm gives. Whoever opens it needs no login, and can send the company's name, address and website, the people to contact (and whether each would like a portal login), certificates and other documents as PDFs or images, and the compliance items that apply with a next due date. TRACE keeps what is sent, together with the network address and browser it was sent from, and holds it as waiting for review: the files sit in a private store, and nothing becomes a contact, document, compliance item or change to the company until a consultant at the firm accepts it. TRACE keeps only a scrambled copy of the link, which works once, lasts 7, 14 or 30 days and can be withdrawn by the firm. Deleting the firm's account deletes all of it.

Signing links, if your firm sends them. When a firm asks someone without a TRACE login to sign — an outside instructor's attendance sheet, a certification's final sign-off, an examiner's, proctor's or evaluator's signature, an inspector's own field report, a safety talk's leader, a work permit's issuer, a radiographer's source log entry, or an employee's acknowledgement of a disciplinary action — TRACE keeps the name and email address the firm entered, who asked and when, and, once the person signs, the name they typed, the time, the e-signature consent they were shown, and the network address and browser they signed from. To confirm it is them, TRACE emails a one-time code to that address; it keeps the code only in a form that cannot be read back, works for 15 minutes, and is discarded once it is used. The request itself — the address, the network address and the browser — is seen by the firm's own staff who can open the record, and by TRACE staff only inside a support window the firm opens. The signature then appears on the record it signs, as "Signed by" the name typed "(email verified)", and is seen by whoever can read that record, as any other signature on it is. The link shows whoever holds it the details of the record being signed — for an attendance sheet or a safety talk, the names of the people on it; for a disciplinary acknowledgement, its kind, date and summary; for a traveler witness point, the traveler and job numbers, the customer's name, the step, the part and drawing, the method and the step's acceptance criteria — and can be signed only once, within 14 days, unless the firm withdraws it. Once it is signed, withdrawn or past those 14 days it cannot be used to sign and no longer shows those details. Deleting the firm's account deletes all of it.

Traveler witness points, if your firm uses them. When a firm asks someone to witness a step on a job's traveler — one of its customer's people, or a third-party inspector — TRACE keeps that person's name, the email address the firm entered (for a signing link) or which of the customer's portal logins was asked, who asked and when. When the person answers, TRACE keeps their answer (witnessed, waived or not witnessed, and any reason they give), the name and title they give, the time, and whether they answered in the customer's portal or through a signing link; through a link it also keeps the network address and browser they answered from, as for any signing link. When the witness signed a paper form instead, the firm records what the paper says — the name and title on it, the answer, the date and any reason — with the scanned paper attached, and TRACE keeps which firm user recorded it; it is shown as recorded from paper, never as the witness's own signature. If the firm asks to agree before a step that was not witnessed goes ahead, TRACE keeps who agreed and when. A customer's portal login can also ask for a step to be a witness point: TRACE keeps their name, the note they write, and the firm's answer, who gave it and any reason for declining. The firm's own staff who can open the traveler see all of it. The job's crew see the witness's name, title, answer and date on the step. The customer company's portal logins see the name of the person asked, the answer, the name and title given and the date, but never the email address, network address or browser. The answer prints on the traveler PDF, including the customer's copy. TRACE staff see it only inside a support window the firm opens. Deleting the firm's account deletes all of it.

Traveler work records, if your firm uses travelers. When a technician starts and stops a step on a job's traveler, TRACE keeps who worked it (their name, which stays on the record even if their login or technician record is later deleted), when they started and stopped, and how long it was; the office can turn that time into a line on the timesheet. TRACE also keeps the batches of consumables the crew say a step used, with who recorded them, and each crew member's acknowledgment of the step's Job Safety Analysis, with who and when. The firm's own staff who can open the traveler see these. A customer's portal login does not: it sees its own company's released travelers — the part, drawing, material and quantity, each step with its result, the name it was signed under and the date, a short description of any rejection and what was decided, and the witness points described above — and never the time, the cost, the batches or the acknowledgments. A firm can also make a Shop TV display link for the shop-floor board. Anyone who holds that link can see the board without signing in: the traveler and job numbers, the part, the current step, how long it has waited, and the first names of the crew on a step, and the customer's name only if the firm switched that on. The firm can cancel the link at any time, it stops working at once if the firm is suspended or loses the Projects module, and TRACE keeps only a scrambled form of it, so our database cannot show anyone the link itself. Deleting the firm's account deletes all of it.

Certificates of conformance, if your firm uses them. A certificate made from a traveler or a set of reports carries what the firm puts on it — the reports, parts, results, rejections and receiving and shipping records it covers — and is signed by the person who issued it, under their own login. Emailing it is covered under "Email" below, and the customer's portal logins can open it.

Vision exams, and suspended certifications. Every firm can record a technician's vision exam: the date and expiry, the acuity and colour-perception results, whether it was corrected, and who gave it (with the signed paper attached where it was given on paper). Your own staff see all of it, the technician sees their own, and the client company the technician works for sees its own technicians' exams. When a vision exam, or the performance review a certification depends on, passes its due date, TRACE marks the affected certification Suspended by itself, and notes which certification it suspended and which due date had lapsed; the Suspended status shows wherever that certification does, and the reason — which exam or review had lapsed, and its due date — is shown with it to your staff and to the client company the technician works for (not how your firm clears it). A certification issued by ASNT itself is never suspended this way. Deleting the firm's account deletes all of it.

How each signature got there. Every name on a sign-off in TRACE says which of three ways it was recorded: signed by the person with their own login; signed through a signing link, as above; or recorded by someone at the firm — either from a signed paper document, which has to be attached to the record and is kept as an ordinary document, or simply as the name of who did the work. A recorded name keeps which login recorded it, and is shown as "Recorded by" that person. Sign-offs a firm entered before October 2026 are shown as recorded by the office.

Calendar subscriptions, if you turn one on. From your Account page you can make a private link that Google Calendar, Outlook or Apple Calendar subscribes to, showing your own schedule and, for a firm's consultants, the firm's compliance calendar. TRACE keeps which login and firm each link belongs to, when it was made or last regenerated, and when it was last collected — not who collected it — and keeps only a scrambled fingerprint of the link, never the link itself. The entries show what is due or scheduled and when: a certification or compliance item and the client company, a job with its number and site address, a meeting, an invoice or bill number. They carry no notes and no amounts, and the firm calendar does not say whose certification is due and leaves out time off, personnel files and screenings. Your calendar app collects them from TRACE on its own schedule and keeps its copy under its provider's terms, not ours. Anyone who has the link can read the calendar without signing in, so treat it like a password; regenerating it or turning it off stops the old link at once. Who may hold it is checked again every time it is collected: if you leave the firm or your login is deactivated, the link answers with an empty calendar, and entries from a module your firm switches off drop out. Deleting your account or the firm's deletes the link.

A connected calendar, if you connect one. From your Account page you can connect your Google account (or Outlook, where offered) so that TRACE writes your TRACE dates — the same titles, dates, locations and links back into TRACE as a calendar subscription carries — into a calendar TRACE creates in your account. TRACE keeps an access grant for it, sealed in its database, together with which login and firm it belongs to, the calendar it made, which of its events matches which TRACE date, and when it last synced. TRACE reads back only the events in the calendar it made — never any other calendar of yours — to notice when you move a job or job visit there; such a move becomes a proposal that your firm's staff accept or reject, and the proposal records who moved it, from which calendar, and the old and new dates. Google or Microsoft keeps the calendar and its events under their own terms. Disconnecting deletes TRACE's calendar from your account and hands back the grant; deleting your account or the firm's does the same.

Where people work, and radiographer cards, if your firm records them. A firm can note the US state each person normally works in and whether they supervise others, and the state a job is worked in, so its own training rules can assign by state; and, with Safety, the radiographer cards a person holds — the kind (a state-issued card, an ASNT IRRSP certification, reciprocity in a state), the issuing state, the card number and its dates. These are seen by the firm's own staff; a person can see their own cards, never anyone else's, and a client company's portal sees none of it. Deleting the person's record, or the firm's account, deletes it. No AI feature reads any of it.

Certificates anyone can check. A test your firm sets to issue certificates, and a course completed in TRACE, each give the person a certificate with a code on it, and anyone holding that code can check it at www.tracendt.com/verify. For a test, the check answers with the name printed on the certificate (where no name is on file, the certificate and the check both say "Name not on file" — never an email address), the test, the firm that issued it, the date, the score and the pass mark — for every certificate such a test issues. For a training course it answers only while the firm has switched checking on for that course, and then with the person's name, the course, the firm, the date it was completed and when it expires; switching it off makes those codes answer as unknown again. A firm can also withdraw a single training certificate: while that course is open to checking, its code then answers only that the certificate was withdrawn by its issuer — not the name, the course, the dates or the reason. A code that matches nothing, and a certificate that is not open to checking, get the same answer. Nobody can look a person up by name — the check needs the code — and each try is noted against the network it came from, as described under "Sign-in and device records".

Billing status: which plan you're on and whether payments succeed. Card numbers stay with Stripe (see below) and never reach our systems, and neither does your billing address or tax ID — those are entered on Stripe's own billing page and held there. If another firm referred you, we also record which firm it was.

Referrals. If you sign up through another firm's referral link or code, the signup page tells you which firm referred you before you create your account, and we record it (our staff can also record it by hand for an introduction made in person). From then on the referring firm can see your firm's name, which plan you are on — including whether you are on a trial or have a payment overdue — when you were referred and when you first paid. Its primary user can also see the referral credit your payments earned it and, for each payment, the amount it was worked out from (what you paid after tax and discounts). It never sees your records, your people or your billing details. To keep referrals honest we compare the two firms: their primary users' email domains, who belongs to both, whether one is the other's own company, and — as Stripe reports it — whether the same card paid for both, by a fingerprint of the card rather than its number. The result goes to our staff for review, not to either firm.

Online payments to your firm. If your firm's primary user connects the firm's own Stripe account, each unpaid invoice gets a private payment link. Your client opens it without an account, sees the invoice, and pays on Stripe's checkout page, directly into your firm's Stripe account: your firm is the seller, Stripe processes the payment under its agreement with your firm, and TRACE takes no fee and never holds the money. The client's card or bank details go to Stripe, never to TRACE or to your firm. When Stripe tells us the payment went through, TRACE records it on the invoice — the amount, the date, the card brand or bank name with its last four digits, and Stripe's reference — and keeps a note of which Stripe account is your firm's.

Buying a course. A firm with Learning can sell one of its courses on a public course page, which it may also show under its own web address; that page is still served by TRACE, sets no cookies, and collects nothing beyond what is described here. To buy, you give your name and an email address, and pay on Stripe's checkout page into that firm's own Stripe account (if the firm has given you a discount code, you can enter it before you pay, and TRACE records which code the sale used); your card or bank details go to Stripe, never to TRACE or to the firm. When Stripe tells us the payment went through, TRACE records the purchase for that firm — your name and email, the course, the amount, Stripe's reference, and the platform fee TRACE keeps on the sale — files you as a person on the firm's Students company with the course assigned, and emails you a link to sign in (or, if you already use TRACE, asks you to link it). If you buy several places for other people, you give each person's name and email on a private page we email you, and each of them is filed and invited the same way. From then on the firm holds your training record as it would an employee's, and the firm decides what to do with it; it can see your purchase and your progress on the course, but never your card. The private page lists the names of the people already given a place, and anyone holding its link can give out the places that are left, so keep the link to yourself.

Emails you send us, and support requests. If you write to support, use the contact form, or send a request from the Help page inside TRACE, we keep the correspondence: what you wrote, your name and email address and the business you gave, and — for a request sent from inside TRACE — which of our staff it is with, whether it is open or answered, and every reply either side has written, whether typed in TRACE or emailed back. A request sent while you were signed in is yours to read and add to under "My requests" on the Help page. Since 3 October 2026 a request a consultant sends is also filed under their firm, and the firm's primary user and any colleague the primary has named IT contact can read it and add to it, under "Your firm's requests" — so don't put anything in one you would not want them to see. Nobody else's login can reach it, whatever email address they have. Be plain about one thing, because the Security section below is about a window: a support request is not one of your records, it is a message addressed to us, so our support staff read it without your firm opening anything. That is deliberate — the alternative is being unable to read a plea for help from somebody who cannot sign in — and it reaches nothing beyond what you chose to write into it. A sponsorship enquiry sent from our Advertise page is filed differently: your name, company, email, what you would like to sponsor and your message go into our own CRM as a lead, which TRACE staff and our marketing team (the people in our TRACE Marketing workspace) follow up, and a copy is emailed to the marketing team members who look after that CRM.

Sign-in and device records. To slow down password-guessing, each sign-in attempt is noted briefly — the email address tried and, on our live service, the network (IP) address it came from — and cleared out after about an hour. The same brief note is made when one of our public forms is sent in, for the same reason and with the same hour: a survey response, a giveaway entry, a contact or lead form, a reply to an estimate or a request to sign off, a certificate check, a support chat. So if you send us one of those without having an account at all, the address you typed and the network you sent it from are held for about an hour and then gone. Separately, and for as long as your account exists, we keep a short list of the places each account has signed in from: the network address and a coarse description of the device ("Chrome on Windows", "TRACE Mobile"), with no more detail than that. It is what lets us tell you when your account is signed in to from somewhere it never has been — see "Watching our own logs" under Security. Since September 27, 2026, while you are signed in to the website we also note, at most once an hour, the approximate place your network address points to — country, region, city and a rough latitude and longitude, as our hosting provider works it out from the address; never your device's own location — so we can tell when one account is used from two places too far apart to travel between. Those notes are kept for 90 days, the phone app makes none, and they go when your account does. Our hosting providers' own logs record the IP address of requests too, as any web server does. And if you use the mobile app with notifications on, we keep that device's push token so a notification can reach it; signing out of the app removes it.

Where a technician is when they clock in — only if your firm switches it on. It is off unless your consultancy's primary user turns it on from the Account page, and nobody else at your firm can. While it is off nothing is kept: TRACE does not ask the browser for a position at all, and if a device sends one anyway — an older copy of the phone app still might — the database discards it before the punch is stored. With it on, clocking in, on a job or on overhead time (hours that belong to no job), asks the browser or phone for its position, which is why the device asks permission first; saying no still clocks you in, and nothing is recorded. If it says yes, TRACE keeps what the device reports — the latitude and longitude, and how accurate the device says that is — while the shift is open, works out how far that was from the job's own site address (an overhead clock-in has no site, so no distance is worked out or kept), and shows that distance to you and to your firm's office. When you clock out the position is deleted and the distance stays with the hours, so what survives the day is how far from site the shift began and not where anybody was. It is asked for at the moment you clock in and at no other: in the browser, only your own record and your dashboard are permitted to ask at all — every other page in TRACE is forbidden to — and on the phone the app asks only while you are using it, never in the background. There is no tracking between clock-ins, no route, and nothing continuous. It is never used to block a clock-in, only to tell the office. It is seen by you and by your firm's own staff, and by nobody else — not by the client company whose site the job is on. Whether to record it at all is your firm's decision, and the law on recording where an employee is differs from state to state, which is why it is a switch somebody has to reach for rather than something that was already on.

Signing off on a job, if your firm asks a customer to. A technician can hand their phone to whoever is signing for the site, or TRACE can email a private link, and that person approves or rejects an inspection report or a charge sheet without any account. What is kept is what a signature is for: the name and job title they type, the signature they draw, the date and time, and — because a signature nobody can place is worth little — the network address and the browser it was signed from. If they reject it instead, what they say needs correcting is kept in place of the signature. The drawn signature is stored as an image in the same private storage as every other document, and it is only ever reached from the record it belongs to. Until it is answered, anyone holding the link can read that one document and its PDF, which is the point of it, so it is meant for the person being asked to sign and is worth treating like the document itself. If it goes unanswered it stops working sixty days after it was sent or last changed, and shows nothing but who to ask. The firm can also kill it sooner, which is worth knowing if you were sent one: its own staff can revoke the link at any time, and sending the document back to be corrected revokes it too — either way the address you were given is dead from that moment and you need a new one. Once it has been answered it cannot be used to sign again, and it no longer shows the document or its PDF to anyone — only that it was signed or declined, and when. The person who signed finds their copy in their company's client portal, if their company has one; if not, they can ask the firm that sent the link for a copy.

Information other people send to a consultancy through TRACE. If a firm switches on its lead form, whatever a prospect types into it — their name, email, phone, company and message — arrives here as a deal. If a firm uses a deal's reply address, the emails exchanged with that prospect are filed on the deal: subject, sender, recipient and the message itself. And a task board can have an address of its own, so that mail sent to it becomes a card on that board — the subject as the card's title, the message and who sent it in its description.

Mail that arrives at one of those addresses and cannot be matched to anything is set aside rather than dropped, so a misdelivery can be traced instead of vanishing. That covers a reply address matching no deal, an address for a board that no longer exists or has no list left to file a card in, and an emailed answer to one of our own support replies that we cannot safely file — one sent from a different address than the request came from, or one answering a request already closed. What is set aside is deliberately thin — who it came from, who it was addressed to, the subject, a reference number for the copy our delivery provider holds, and the reason it could not be filed, but not the message itself — and it belongs to no consultancy, so nobody's account can reach it and only we can read it. We keep it for 90 days and then delete it automatically, which is long enough for someone who notices a reply never arrived to ask us to look; if a message of yours went astray this way and you want it gone sooner, ask us and we will delete it.

The people in those messages, and the person who signs off on a job, are not our customers and did not sign up with us. The consultancy that collected the information decides what to do with it and is responsible for it; TRACE holds it on their behalf, exactly as it does for the client and technician records described below. If you have sent something to a firm this way, or signed something for one, and want it corrected or removed, ask them — and if that goes nowhere, ask us. One thing to expect about a document you signed: once it carries a signature TRACE will not let anyone edit it, so a correction is issued as a new revision and the version you signed is kept beside it rather than replaced. That is deliberate — a signed record whose contents could change afterwards would be worth nothing — but it means correcting something adds a version rather than rewriting one.

If your consultancy connects its QuickBooks Online company, TRACE sends it what your books need, at your direction and to your own company: the names of the companies you bill, your Sent invoices with their line items, dates and tax, and the payments recorded against them. Nothing else goes, and TRACE reads nothing back beyond your QuickBooks company's name and its list of products and services. The permission Intuit asks you to grant is wider than that — its accounting permission covers the company's accounting data as a whole, and Intuit offers nothing narrower — so what limits TRACE to those records is TRACE's own code, not the permission. The access Intuit grants is stored encrypted on our servers, and disconnecting revokes it. From then on those records are also held under Intuit's own terms and privacy policy. The connection is built but not switched on yet, so no consultancy can connect QuickBooks today. QuickBooks and Intuit are trademarks of Intuit Inc.; TRACE is not affiliated with or endorsed by Intuit.

Giving another program a key to your records. Your primary user can make API keys, so that another program your firm runs can read your records and, where you allow it, write them. A key reaches only your own firm's records and only the kinds you ticked when you made it: technicians, certifications, compliance items, companies, jobs, field reports, documents, safety training, dose readings, radiation sources and the source log, job safety analyses, the cards, licences and screenings in the People module, vision exams and time off. Two of those hand over files and not just details — a document comes with a link to the file itself, good for a few minutes, and a field report with a link to its PDF — and a key given documents does reach the ones your staff marked for your own consultants only, because a key acts for your firm rather than for a portal login. Where a record goes after it leaves through a key is between your firm and whatever program holds it: that program is yours, not one of our providers, and we are not party to what it does. On our side we keep the key's name and the short readable part of it, never the key itself — only a scrambled fingerprint made with a secret held on our server, so nobody at TRACE can read a key back to you and a stolen copy of our database matches none — and we record every call: which key, what it asked for, how many records came back, when, and the network address it came from. Anything written through a key goes into your change history under that key's name, so your staff can tell it from something a person typed. Revoking a key stops it, and so does leaving the plans the API comes with — Plus, Pro and Enterprise: on any other plan, including an account that pays for a single module on its own, every key is refused until the firm is on one of those three again.

If you answer our Certification Currency Survey, your answers are anonymous: since October 3, 2026 they are stored with no name, no email address and no time of day, only the day they arrived. Responses sent before then no longer hold an email address or which follow-ups the person asked for either — those were cleared on October 5, 2026 — but still carry the time they arrived, which only TRACE staff can see. TRACE staff and TRACE's marketing team — the people in our TRACE Marketing workspace, who run the survey for us — review individual responses: each one's answers, including anything you wrote in your own words, and that day; never the link that brought you, and nothing they see is linked to an entry in our giveaway. If you ask us for the findings, an interview or to be contacted, your name and contact details (email, and a company and phone number if you give them) go into our own CRM, separately, as a lead our marketing team follows up on, along with what you asked for — never your answers, and nothing on the lead points to them. Anything published from the survey is reported in aggregate, and your own words are quoted only anonymously — read first for names, and not at all if you have asked us not to quote them.

If you enter one of our giveaways — offered after our Certification Currency Survey, or on its own free entry page — we keep your name, your email address, the day you entered, how you entered (after the survey or the free way), the campaign tag on the link you arrived by, and whether you ticked the separate box asking for TRACE news. We use it only to hold the drawing, contact the winner and keep a record of how the winner was drawn; we add you to TRACE news only if you ticked that box. Your survey answers are stored apart from your entry, and the entry proves only that someone finished the survey, not which answers were theirs: it carries a one-way token and the day it arrived, not the time, and neither record points at the other. Survey answers given since October 3, 2026 carry no name or email address either, so nothing connects them to your entry. If you also asked us to follow up after the survey and enter with the same email address, that address is on both your follow-up request and your entry — your own contact details twice, never your answers. Only TRACE staff can see entries, and they are deleted 90 days after the drawing. The record of the drawing keeps entry reference numbers, not names or email addresses.

If you ask for the NDT word of the day by email on our games page, we keep your email address, whether you have confirmed it, when you asked, confirmed or unsubscribed, a scrambled copy of the one-time confirmation link (the link itself is only ever in the email we send you, and it works once, for 48 hours), a random key that lets the unsubscribe link in each email take you off the list, and which days we sent you the email. Nothing is sent each day until you press the confirmation link. Every email says why you are getting it and has a one-click unsubscribe link; a new request after unsubscribing needs a fresh confirmation. An address that is never confirmed is deleted about 30 days after its link expires, an unsubscribed one about 30 days after unsubscribing, and the record of which days we sent it after 90 days. The emails go out through Resend, our email service. Only TRACE's servers read the list; it is not shown to anyone, used for anything else or joined to an account. If you have a TRACE login, you can instead have the same daily word added to your reminder digest, from Account, Notifications; it is off unless you turn it on.

No selling or renting your data to anyone, for any reason.

No advertising, ad networks, or ad targeting.

No analytics trackers, tracking pixels, or fingerprinting — browsing our site leaves no trail with advertising or analytics companies. Apart from a sponsor's logo (described next), the one outside service a public page loads is Cloudflare's bot check, which opens with the contact form on the home page, with the sign-in box when you open it, and on the signup, password-reset, survey, giveaway entry, Advertise and lead-form pages (and on the games page once you start filling in the daily email form), and sets no tracking cookies. Some free pages (the tools, guides and conference calendar) can carry a labelled sponsor block: an ordinary link, and a logo kept in our own file storage at Supabase (listed above), which your browser fetches from there with no cookie and without saying which page it is on. Nothing about you is sent to the sponsor or recorded by us.

No training AI models on your compliance data.

No reading your data except to operate the service — or when you explicitly ask us to help with your account.

Visitors browsing the site get no cookies at all. Three things you start can set one before you are signed in. Signing up, asking for a password-reset link, or choosing to sign in with Google or Microsoft sets a one-time sign-in cookie whose only job is to let that sign-in finish. And someone taking a test from a share link gets one short-lived cookie when they start the attempt, because a candidate with no account still needs something to hold their place between questions. And opening a TRACE traveler's QR code — the code printed on a work order — before signing in sets a cookie for at most fifteen minutes that remembers which traveler to show once you have signed in, and is deleted when you get there.

Signing in sets the session cookies that keep you logged in as you move between pages, plus display-preference cookies you set yourself (whether you chose Light, Dark or System, the collapsed sidebar, the technician record you viewed last). Connecting QuickBooks Online or your own mailbox sets one more for ten minutes, while you are away at Intuit, Google or Microsoft, so TRACE can check that the answer coming back is for the connection you started. They're strictly necessary or a display preference you set yourself, which is why the notice at the bottom of the screen tells you what's happening rather than asking you to accept or reject — there's nothing optional to consent to.

See the full Cookie Policy

If a consultancy invited you to TRACE — as a client company user or a technician — the records about you were entered and are managed by that consultancy. TRACE stores that data on their behalf. Questions about correcting or removing it should generally start with them; we'll assist either way.

Which consultancy that is can change. A company can move from one consultancy to another, and its records — including records about its technicians — move with it, coming under the new consultancy's management. It cannot happen behind the company's back: the outgoing firm releases, the incoming firm presents a code the client itself passed on, and the company has to accept. If you're a technician whose records sit with a company that moves, ask them who advises them now.

A client can also move up to a workspace of its own. If the consultancy that has been keeping your program invites you and you sign up, you hold that workspace and its subscription yourself, and the program kept for you — your technicians, their certifications and training, your compliance items, program documents, controlled procedures and forms, and your appointments — is copied into it. From then on the copy is yours. The consultancy keeps its own rows as history it can read but no longer change, and the commercial records it raised — its jobs, reports, estimates and invoices — stay with it, because changing how you are advised does not settle an account.

If you hold your own workspace you can let one other firm into it, and this is the only place in TRACE where one consultancy reads another's compliance records. Your primary user can give a named consultancy standing access as your Level III — nobody else at your firm can, and nobody at TRACE can do it for you or for themselves. While that grant stands, that firm's consultants can read your program: your company record, your technicians and their certifications, training and compliance items, your written practices and appointments, and your program documents and controlled procedures. They can deliver and approve procedures, forms and technique sheets, issue new revisions of documents they wrote, and sign your certifications as your Level III — your own certifying authority still gives the final sign-off, a certification counts as signed only then, and anything changed in between cancels their signature so it has to be given again. What they cannot reach is everything else: your own clients, your invoices and billing, your logins, the internal notes you keep about yourself, and any document your staff marked for your own consultants only. They can delete nothing. The grant and everything done under it are written into your own history, it stops the moment either firm is deactivated, and either side can end it whenever they like — the next thing that firm asks for is refused, with nothing cached. It is a separate thing from the support window TRACE's own staff need, and neither one opens the other.

In the United States. The database and every uploaded document sit in Supabase's US East region (AWS us-east-1, Northern Virginia), and the application itself runs in the matching Vercel region in Washington, D.C. Server-side processing of your records happens there too.

Two honest footnotes. Vercel's edge network serves the site's own static files — logos, stylesheets, scripts — from wherever you happen to be, which is how any modern site loads quickly; none of your records are among them. And the nightly encrypted backup goes to a separate provider, which is the point of an offsite backup: Cloudflare R2, in its Eastern North America region. We will not round that up to "the United States" for you — it is a placement hint rather than a jurisdiction lock, and eastern North America includes Canada. What we can tell you is that the copy is encrypted before it leaves us, with a key Cloudflare does not hold, so whatever rack it sits on it is unreadable to anyone but us.

A third, if your team uses the phone app. Some of what the app is for happens where there is no signal, so the phone keeps a little on itself: a tool check, a source check-out, a job safety analysis, a toolbox talk, hours (including an overhead clock-in), a receipt with its photo, or a field report with its photos made offline waits in the app's own storage until it sends, and the app keeps the last copy it saw of your name and role, of the source log, and of the jobs and report forms a technician can report on — with each job's customer, site, purchase order and equipment — so those screens still open in a vault. It sits in the app's private storage, which other apps on the phone cannot read, and it goes when the app is uninstalled. Signing out ends the session, stops notifications reaching that phone, and forgets those caches. The one thing it keeps is work you made offline that has not reached us yet — that is yours, it is marked as yours, and the next person to sign in on that phone can neither see it nor send it. Losing the phone is worth treating as losing a filing cabinet page: lock the screen, and tell us or your consultancy so the account can be dealt with.

A fourth, if a technician chooses it for their own computer. Field Reports on the website can be made available offline on one computer at a time, by the technician, from that computer. It then keeps, in the browser's own storage on that computer, a copy of the jobs they are crewed on, the report forms for them, what the form fills in from the job (customer, site, purchase order, the job's equipment), their own draft reports, their own draft charge sheets (hours and quantities — never prices), their own logged hours of the last two months, and the name and logo of the firm their reports print under — and the reports, photos, charge sheets and hours they write with no signal, until those reach us. A DRAFT PDF of a report can be made from that copy in the browser; it is marked as a draft on every page, is not the issued report, and is not stored by us. Everything kept is encrypted under an offline passcode the technician chooses, which never leaves the computer; we cannot read it and cannot recover it. The copy of our data is deleted when they sign out, when someone else signs in on that computer, and after 14 days. Reports not yet sent are kept until they are — readable only by their author, after signing in as themselves and typing their passcode — and the sign-out screen says how many are waiting. It is not offered to the shared demo workspace or to TRACE staff, and it is meant for a computer that is the technician's own, which the page says before anything is kept. A consultant can do the same from Reports on their own computer: it then keeps, for the firm they are working in when it is set up or refreshed, that firm's scheduled and in-progress jobs (number, name, customer, site, purchase order and equipment), its report forms, the crew of each job with each person's certifications in the job's methods (name, method, level, due date and standing — no contact details, personal documents or rates), the firm's technique library (names and wording), its name and logo, and the consultant's own draft reports — under the same passcode and the same deletion rules. A report written there is filed only in the firm it was written in: if their sign-in is working in another firm when it is sent, it waits, and says so, until they switch back.

Every connection to TRACE is encrypted (HTTPS), and data is encrypted at rest.

Access controls are enforced in the database itself, per account and per role — your compliance records are invisible to every other consultancy unless you let one in yourself, and client or technician logins see only what applies to them. Three things cross that wall deliberately. The Community area is shared with every member and holds no compliance records at all. Standing Level III access does hold them — but only where your own primary user has granted it to one named firm, and only for as long as they leave it standing. And since October 9, 2026 a task board can be shared with one other firm: one of your consultants invites that firm to one board, by its primary user's email or a one-time share code, and one of its consultants accepts. Each firm can then see the other's name. That firm's consultants — not its technicians or client logins — can see and work that board's lists and cards: the names, descriptions, due dates, checklists, labels, comments, attachments and the names of the people on the cards, and the names of your firm's staff, so that they can be put on a card. They see nothing else of your firm: not your other boards, not the jobs or companies a card is linked to (only that a link exists), not the board's history, which stays in your own audit trail. Whatever they add to the board is your firm's record. Either firm can end it at any time, and access stops the moment it is ended. Nothing else crosses it.

That wall holds against us too. TRACE's own staff can't read your records by default — documents, financials, technicians, certifications, exam results. Support access has to be opened on your account for a fixed window measured in hours, and only someone at your own firm can open it — any of your consultants, so whoever is actually stuck with the problem can let us look without hunting for a colleague first; we can ask for a window, we cannot grant ourselves one. It closes by itself, our staff can close it early but never extend it, and every grant is recorded in your consultancy's own audit trail, so you can see when we had access and when it ended. What stays visible to us without a window is the account itself: your consultancy's name, plan, which modules it has and whether it pays for them, its sign-in accounts and how many of them have signed in lately, a count of your client companies — not their names or anything about them — how much storage your firm's documents take up and how many AI credits it has used, as two totals and never the files or the AI requests behind them, and, since the API arrived, your API keys as settings rather than content: a key's name, the short readable part of it, what it is allowed to reach, when it was made and when it was last used. Never the key itself; nobody here has ever held one. We can also revoke a key without a window, which is the one thing on this list we can do rather than see. It only takes access away — it cannot read, change or add a record — and an emergency switch that waits for you to open something is not one; a key turning up in public is the case it exists for. When we use it we email your primary contact and say why, and the reason is written on the key and into your audit trail. Our scheduled jobs count a little more than that, without anyone reading it: how many technicians, certifications and compliance items you have entered, and which NDT methods and quality programmes your companies are marked with. That is what the getting-started note ten days in is reasoned from, and it goes to your own primary contact and nowhere else. No document, no record, no name, and never a report to us about your firm. One thing sits outside the window on purpose and is named here so the list is complete: a support request you send us, and the replies on it, are read by our support staff without one — that is a message addressed to us rather than a record of yours, and "Emails you send us, and support requests" above says what it holds. Since 3 October 2026 the people answering those requests may include TRACE help desk logins, who are not full TRACE staff: they read support requests and your account details as listed above (name, plan, status, primary contact, which modules you have and whether a support window is open), and inside a window your firm opens they can read your records but cannot change, add or delete anything. They cannot change your billing or your plan, issue refunds, or reach our staff tools or settings, and none of it opens until they have completed the second sign-in step.

One honest limit on that. The keys that run the service itself are not subject to those rules, and cannot be: a nightly backup that the access rules could refuse would not be a backup. The same is true of applying a change to the database, running the scheduled jobs, carrying out an import or a repair your firm has asked us for, and maintenance we decide on ourselves — a conversion or a correction run across filed records, such as the one that made the PDF copies of Word documents described under "Data retention and deletion". Work like that reads your files, on the machines of the people who run TRACE and with the tools on them; nothing about it sends a document to anyone outside TRACE. The application holds such a key as well, and uses it for parts of the ordinary work you do inside TRACE — creating a login for a colleague, recording a plan change — where the step has to touch something your own sign-in is not allowed to reach. Where it does, the code has to make the same check the database would have made, and a place where it did not is a defect to us: our own audits look for them, and the two found in September 2026 (a read-only account able to write through one of these doors) were fixed the day they were found. Those keys are held by the few people who operate TRACE and by the application they run, and are used for running it and for work you have asked for — never as a way around the support window. So the promise above is precise rather than absolute: the window is what governs us looking at your records to answer a question, and it is not a claim that nobody at TRACE holds a database key. Any provider that keeps a backup for you holds one; we would rather say it than let you assume otherwise.

Watching our own logs. TRACE has always recorded a great deal — who changed a record, who opened a document, who signed in from where. Since September 19, 2026 we also read it, once an hour, and say something when it looks wrong. Two different people hear about it. If your account is signed in to from a network address it has never been used from before, the email goes to you, with the time, the address and the kind of device, because you are the only person who knows whether it was you. And a handful of patterns raise a note to TRACE's own staff: one login opening more than sixty documents in an hour, one person deleting more than twenty-five records in an hour, a change to somebody's role, a change to a consultancy's primary user, someone joining or leaving a firm, and a support window being opened. Be clear about what that note contains, because it is read without a support window: the person's name and email, the firm's name, and a count — sixty-three documents, thirty records, these tables. It does not carry a document, a record, a field value or anything you typed. We would rather notice a stolen login in an hour than preserve a rule that nobody would thank us for keeping. Since September 27, 2026 a third audience hears too: your own firm. Each note that concerns your firm, every new sign-in and "two places at once" alarm for one of your firm's logins, and any use of the "this wasn't me" link in those emails, is listed on your firm's Account page for its primary user and the consultants the primary user chooses — naming your own people, never another firm, with our staff shown only as "TRACE staff". The "two places at once" alarm also emails your firm's primary user. What the watch remembers is described under "Sign-in and device records" above, and it goes when your account does.

Two-factor authentication is required on consultancy staff accounts and on client-portal logins — an authenticator app, or a one-time code emailed per sign-in — and available on every other account; a consultancy can require it of its technicians too. Our read-only demo workspace is the exception, twice over, and the two halves work slightly differently. While the workspace you are working in is the demo, you are not asked for a second step — that includes someone who has a firm of their own and is looking around the demo, and it lasts only as long as they are in it: switch back to your own firm and the step is required again before any of your records will open. And an account that belongs to the demo and to no real firm — the shared login we publish, and anyone who has only ever been let into the demo — cannot add an authenticator or a passkey at all, because that workspace is shared with whoever else is looking around: one person's authenticator would lock the rest out, and one person's passkey would leave them a way in of their own. Join a real firm and both come back. Since September 30, 2026 there is a third refusal, narrower than those two: the demo workspace's own shared logins — the one we publish and the demo client and technician logins beside it — cannot change or reset their password. One visitor choosing a new password on the tablet at a trade stand would take the demo away from the tablet and from everyone after them. That one is checked when the form is submitted rather than by the database, and it reaches only those shared logins: if you have an account of your own that was let into the demo, your password is yours as it always was. A passkey satisfies the step on its own, being both something you hold and something only you can unlock. Sign-in attempts are rate-limited to slow down password-guessing.

When you choose a password — signing up, changing it, or resetting it — we check whether that exact password already appears in a published breach, and refuse it if it does. The password does not leave our server to do that, and neither does anything that identifies you: it is scrambled one way, the first five characters of the result are sent to the public Have I Been Pwned list, and the list sends back every scrambled password starting with those five characters, so the comparison happens here. The service learns nothing about who asked or what the password was. If it is unreachable, your password is accepted — a check like this must never be the reason nobody can sign up.

No system is perfectly secure, and we won't pretend otherwise — but security is engineered into TRACE at the database layer, not bolted on top.

See how TRACE is secured and scanned

Community — the member profiles, the forum, and mentoring — is the part of TRACE that is shared across consultancies with nobody having to grant anything. Everything else in your account is walled off to your consultancy unless you open a door yourself; this isn't, because a members' space that only your own colleagues could see wouldn't be one.

It is opt-in twice over. Nothing about you appears there until you fill in the profile questionnaire, and until you do, you cannot post at all. What you put in that profile — your display name, headline, bio, region, years of experience, methods, and any certifications summary — is visible to consultants and admins at other consultancies. Anything you post is visible to them too, and to any technician a consultancy has let into that topic. You can hide your profile from the directory at any time from within Community.

Two limits hold regardless: client company logins have no access to Community's profiles, forum or mentoring (the games leaderboard below is the one part any signed-in login can see), and technician logins see only the specific topics their consultancy has explicitly granted them — none by default, and none of your compliance data — companies, technicians, certifications, documents — is ever visible there. Only what you typed into Community yourself.

Posts are attributed to the name on your profile. If your account is later deleted, your posts remain with that name attached so conversations don't lose their replies.

Reporting and blocking. Any member can report a Community thread or reply that they can see. We keep the report — which post, who reported it and under what name, and the reason they gave — and it goes to TRACE's administrators and Community moderators, who can hide the post (it then stays visible only to its author and to them), remove it, restore it or dismiss the report; the decision is kept on the report. A member can also block another: we keep a list of whom you have blocked, which you can read and change, and a blocked member's threads and replies are kept out of your view, and neither of you can ask the other for mentoring. Unblocking puts everything back.

The games leaderboard is part of Community too, and it is opt-in. If you play our free NDT games while signed in, TRACE keeps today's first finished puzzle in each game: which game and day, the topic and size, your score, how long it took and how many guesses, reveals or wrong tries it needed — and, for the word of the day, the pattern of colours, not your guesses. Played signed out, nothing is kept. Your results are shown to other people only if you choose to appear on the leaderboard, and then only as your Community display name (or, if you have no Community profile, a leaderboard name you choose, which cannot hold an email address or a link) beside your points, games played, total time and daily streak. That is visible to anyone signed in to TRACE, from any firm and in any role. Your email address and your company are never shown. You can stop appearing at any time; you will still see your own place, privately. TRACE staff can see who is behind each listed name in order to hide a player or a result that shouldn't be there, and every hide is recorded in the audit trail. Deleting your account deletes your results.

We never sell or share your address. TRACE keeps its customers' firm and contact details — the name, email address and phone number of each consultant, the firm's name, its plan and the date it signed up — in its own customer-relationship records, to manage the account relationship and to send service messages and, where the law allows, messages about TRACE itself. Each of those marketing messages is written to you by a person on our team, one at a time, and says how to stop them; asking once is enough, and we note it on your record. We don't send bulk marketing mail. When a firm's account is deleted, or one person's login is, those customer records are kept, marked as a former customer with the date, so the relationship has a history and a firm that comes back is not filed twice. Anyone can ask support@tracendt.com to have their own contact details removed from them; once removed, they are not added back. The email TRACE sends by itself belongs to your account: due-date digests (which carry Code Watch releases when a standard you track changes), the link confirming your address when you sign up, sign-in codes, warnings about failed sign-in attempts and a notice when your account is signed in to from somewhere it has not been used before, password resets and confirmations when your sign-in email changes, invitations and requests to link or open access, alerts such as a failed tool check or a new lead, notices about your trial or plan, a note to your primary contact if we have had to revoke one of your API keys and why, a notice to your primary contact before a material change to the Terms takes effect — which the Terms promise and which we sent for the first time on September 30, 2026 — and two getting-started notes in a new firm's first weeks — one on the setup steps still open, one on the modules that fit the records you have entered — each sent once.

Some of it also talks about TRACE itself. A consultant's digest can end with a feature tip, or an add-on you don't have yet and its price; the welcome email on a Free account mentions the paid plans; and the trial emails say what keeping a module costs. One goes further and is worth naming on its own: about ten days in, your firm's primary contact gets a single note suggesting up to three modules that fit the work, each with its price. It is the only automatic message TRACE sends whose whole purpose is telling you about something for sale, and the only one reasoned from your own records — nobody reads them, but our system counts them, and it is those counts that decide what the note says and whether it is worth sending at all. You can turn off the digest email, and the Code Watch section inside it, on your Account page; that same switch stops the module note, which says so in its own text. The in-app reminders keep coming either way. The rest — including the setup note in the first week — are part of running your account and have no switch.

When you send an estimate, an invoice, a statement of account, a certificate of conformance, or a deal email from TRACE, or invite someone into your workspace, your client portal or their technician record, it goes to the people you address, and you decide who receives those. It arrives under your firm's name: by default as "Your Firm via TRACE" from TRACE's sending address, with replies going to you; from your firm's own domain once your primary user has set one up; or from your own mailbox, if you have connected one (below). Setting up your own domain works today: your primary user enters the domain on the Account page, TRACE registers that name with Resend, our email provider, and shows you the DNS records to publish; once Resend reports them in place, your firm's mail leaves from your address rather than ours. That registers a name, not a mailbox — it gives TRACE and Resend no way into any mail at your domain, and the mail itself travels exactly as it did before. If your primary user switches on payment reminders, TRACE also emails the recipients of an unpaid invoice up to four reminders on your firm's behalf; that is off unless you turn it on, and any single invoice's reminders can be paused. A certificate of conformance goes only when the person issuing it ticks which of the customer's contacts should get it: the email carries a link to the customer's portal and the certificate as a PDF (never an editable file), and TRACE keeps who sent it, which contacts, the addresses as they were that day and when, as a record that cannot be changed. We may also write to a customer ourselves to ask whether they'd share a testimonial.

Connecting your own mailbox. A consultant can choose to connect their Google or Microsoft 365 mailbox from the Account page, so that the mail they send from TRACE leaves from their own address and sits in their own Sent folder. The access you grant is to send mail as you and to tell TRACE which address that is — nothing that can read, search or list your mail, so TRACE never sees what is in your mailbox unless you also turn on mail logging in Clients (next paragraph). We store your address and that access, encrypted, and nothing else from your account. A mailbox belongs to you at one firm: if you work with more than one, each has its own connection, and leaving a firm removes the one you made there. Each message sent this way — its recipients, subject, text and any attached PDF — goes to Google or Microsoft instead of to Resend, and is then held under their terms as part of your mailbox. That includes an invitation you send, whose link lets the person you invited set up their sign-in, so a copy of that link sits in your Sent folder. If your primary user connects theirs, it also carries the firm's automatic mail: payment reminders, statements and exam notices. You can disconnect from the Account page, or remove TRACE from your Google or Microsoft account's security settings at any time; either way your mail goes back to being sent by TRACE, and nothing is lost. What TRACE receives from Google, and the Limited Use rules it follows, are set out in "Information we receive from Google" below. Google, Gmail, Microsoft and Microsoft 365 are trademarks of their owners; TRACE is not affiliated with or endorsed by either company.

Logging mail in Clients. If your firm uses Clients, you can separately allow TRACE to read your connected mailbox's list of messages — who each one was from and to, its subject and date, and the short preview line your provider shows beside it where it supplies one; never the full message or its attachments — so that mail you exchange with the firm's contacts in Clients is filed on their records. It is off until you turn it on, and asking for it means signing in to Google or Microsoft again to grant that extra permission. Microsoft 365 mailboxes can do this today. For a Google mailbox it is not offered yet: reading a Gmail message list needs a permission Google reviews before an app may ask for it, and TRACE will offer it only once that review is passed. TRACE then checks, when you press Check for new mail or every hour if you switch that on, and keeps only messages where a contact in Clients is a sender or recipient: the subject, the addresses, the date, a short preview line where your provider supplies one, and a link that opens the message in your own mailbox. Mail with anyone who isn't a contact is looked at only to see that it isn't, and is not kept. What is kept is visible to the people at your firm who use Clients, like the rest of a contact's history, and anyone in the firm can remove a message from a record; it stays in your mailbox either way. No AI reads any of it. TRACE's staff do not read it either, and mail logged from a Google mailbox is outside even a support window your firm opens. Disconnecting, or removing TRACE in your Google or Microsoft account, stops the reading at once; mail already logged stays on the records until someone removes it or the firm's data is deleted.

Logging mail by BCC or forwarding. Instead of connecting a mailbox, anyone using Clients can ask for a personal logging address and copy it into BCC, or forward email to it. That email reaches TRACE the way mail to a deal's reply address does: it is received by Resend, our email provider, and TRACE reads it to find who it was from and to, its date and subject — for a forwarded email, those of the original message inside it — and a short preview. From that, TRACE keeps exactly what mailbox logging keeps: the subject, the addresses, the date and a preview of up to 300 characters, filed on the matching contacts and visible to the people at your firm who use Clients; never the full message or its attachments. An email where nobody is a contact in Clients yet is kept for 30 days in a list only you can see, so you can file it or discard it, and is then deleted. The address only accepts email sent from your own addresses — your sign-in address, a mailbox you have connected, and any extra address you prove is yours by entering a code we email to it — and only when the sending domain's own email authentication (SPF or DKIM, as reported by Resend) shows it really came from that domain's mail servers; anything else sent to it is dropped without being stored. When an email from one of your own addresses is refused for that reason, TRACE keeps only the time and a short reason code, never the email's addresses, subject or content, so your Account page can tell you it happened. When you set up Gmail to forward to it, the confirmation code Gmail sends is shown to you on your Account page until you hide it. You can get a new address at any time, which stops the old one working at once.

If this policy changes in any meaningful way, we'll update the date at the top and note the change here. We won't quietly weaken it.

October 17, 2026: several disclosures for things already happening. "What we collect" now describes the posting rules you agree to before your first chat message or Community post (what is kept: that you agreed, which version and when), the private link a firm can send a client to fill in its own details (including the network address and browser it was sent from), a photographed business card (read by Anthropic, only when your firm has AI on, and kept with the contact), and, under "Buying a course", discount codes and a firm showing its catalog under its own web address. The provider list says Anthropic reads those cards and that Google and Microsoft calendars can be connected, and "Information we receive from Google" names the one calendar permission TRACE asks Google for. Nothing about how any of it is used has changed.

October 16, 2026 (later): "Email" said TRACE doesn't keep a marketing list. TRACE now keeps its customers' firm and contact details — each consultant's name, email address and phone number, and the firm's name, plan and signup date — in its own customer-relationship records, to manage the account and to send service messages and, where the law allows, messages about TRACE written to you one at a time, each saying how to stop them. When a firm's account or a person's login is deleted, those records are kept, marked as a former customer with the date, and anyone can ask support to remove their own contact details from them; "Data retention and deletion" and the /delete-account page say so too.

October 16, 2026: "What we collect" now describes a connected calendar. If you connect your Google account (or Outlook, where offered), TRACE writes your TRACE dates into a calendar it creates there, keeps a sealed access grant for it, and reads back only that calendar's events so that a job or visit you move there becomes a proposal your firm accepts or rejects. Disconnecting deletes TRACE's calendar and hands back the grant.

October 16, 2026: "What we collect" now describes the NDT word of the day by email. If you ask for it on our games page, we keep your email address and when you asked, and send nothing each day until you confirm it from the link we email you. We also keep which days we sent it. Every email has a one-click unsubscribe; addresses never confirmed or unsubscribed are deleted after about 30 days. Cloudflare's bot check now also runs on that form. Signed-in people can instead add the daily word to their reminder digest; it is off unless they turn it on.

October 16, 2026: "Data retention and deletion" said that if you cancel, you email us and we delete your account. Cancelling now does it on a timetable, the same one the Terms (section 10) now state: the workspace keeps working to the end of the period already paid for, is read-only for 30 days so you can download and export what you need, and is then deleted automatically, with a reminder to the primary user about a week before. Until then the cancellation can be undone. Moving to the Free plan is not cancelling and deletes nothing. The content-free note that survives a deletion now also says when the firm cancelled and when its window ran. If we end a firm's account under the Terms, the same window applies from that day. No account is deleted this way before November 16, 2026.

October 16, 2026: four disclosures for things already happening. "Training" now says what Learning adds to what we note while someone works through a course (time on a lesson and how much of a hosted video was watched) and that a hosted video is stored privately and deleted with the firm. "Buying a course" now says the private page for handing out places shows the names already given and that anyone holding its link can give out the rest. "The Community area" now says what a report and a block record and who sees them. And "Getting the app" says the app is available through Google Play and what that does and does not tell us.

October 15, 2026: A firm's own Stripe connection is now live, so "Online payments to your firm" no longer says it isn't switched on. A new paragraph, "Buying a course", says what we record when someone buys a course a firm sells — their name and email, the course, the amount, Stripe's reference and TRACE's platform fee — that the buyer is filed with the selling firm and invited to sign in, and how places bought for other people work. Stripe's entry in our list of services says course payments go through it too.

October 10, 2026 (later): "Data retention and deletion" now says how one person asks for their own login to be deleted — by email to support@tracendt.com from the address they sign in with — what goes, and the two things that stay: the firm's records about their work, and a login credited on signed or approved work, which is set Inactive rather than deleted. Nothing about what we delete changed; the section was written for a firm cancelling and said nothing to a single person. A new page, /delete-account, sets out the same steps for anyone using the TRACE NDT phone app.

October 10, 2026 (corrections): "Data retention and deletion" said deleting your account clears the private holding area for uploads. That is true when a firm's data is deleted and not when one person's login is, so it now says so and offers to clear a file you never submitted on request. The Expo entry now says Expo also serves the phone app's updates, seeing only the phone's network address and the app version, never a record.

October 10, 2026: Three corrections to "What we collect". It now says what the phone app's camera is used for: scanning the QR code on a traveler, where the picture is not recorded or sent and only the traveler's reference goes to TRACE, and photographing a receipt or other record you choose to file, which is sent and kept like any file you upload. It says a client company can now see why a certification was suspended, not only that it was. And it says your primary user can switch chat off for the firm without deleting what was written.

October 9, 2026 (corrections): "What we collect" now describes what travelers keep: the time a technician spends on a step, the batches a step used, each crew member's safety-analysis acknowledgment, and the Shop TV link, which lets anyone holding it see a shop-floor board without signing in. It also says what a customer's portal sees of a traveler, that a certificate of conformance can be emailed to the customer's contacts and that each send is kept, and that vision exams are kept for every firm, not only those with HR Records, and that TRACE now suspends a certification by itself when its vision exam or performance review lapses. The Security section says each firm sees the other's name on a shared board, and "Data retention and deletion" says what happens to a shared board when either firm is deleted. Two descriptions of AI reading were too narrow: reading a training certificate also sends the typed text already read from its other pages, and reading a calibration certificate also sends the file's name.

October 9, 2026 (latest): Security now describes a third thing that crosses the wall between firms. A firm can share one task board with one other firm, which accepts the invitation; that firm's consultants can then see and work that board — its lists, cards, comments, attachments and the people on them, and the names of the sharing firm's staff — and nothing else of the sharing firm. Either firm can end it at any time, and it ends at once.

October 9, 2026 (later): Anthropic's entry names one more use of AI. Tool Control can make the equipment your calibration certificates are for. TRACE reads each certificate's name, folders and text itself; for a certificate that is a scan, your staff can press Read with AI, which shows the credits first and then sends only the first pages of that certificate, and the file's name, to Anthropic to read the instrument, serial number, dates and lab. What comes back fills in the equipment for your staff to check before anything is saved. It spends your firm's own AI credits and stops when your primary user turns AI off.

October 9, 2026: Anthropic's entry names one more use of AI. When one of your staff adds a training certificate and some of its pages are scans or pictures (or it is a photo), the form says which pages TRACE's own text reader can't see and offers to have your firm's AI read them, showing the credits first. Only when they press that button are those pages — not the file's other pages, though the typed text already read from them goes along for context, up to about two thousand words — or the photo sent to Anthropic to be read; what comes back fills in the form for your staff to check and save. Like every other AI feature here, it spends your firm's own AI credits and stops when your primary user turns AI off.

October 9, 2026: "What we collect" now describes traveler witness points. A firm can ask one of its customer's people, or a third-party inspector, to witness a step on a job's traveler, and the witness answers in their own name — in the customer's portal, or through a signing link confirmed with a one-time code. TRACE keeps who was asked, the answer, and the name and title the witness gave, and for a link the network address and browser, as for any signing link. An answer can also be recorded by the firm from a signed paper, with the paper attached and the recorder named. The customer's portal logins now also see their company's released travelers, with those answers but never anyone's email address, and can ask the firm to make a step a witness point.

October 8, 2026 (latest): Pay and leave are new, and "What we collect" now describes them as a kind of record of their own. A firm that has HR Records or Project Management can keep a person's payroll file number, pay rate history and PTO and sick-time account, and lock a pay period to export the hours as a file for its payroll system. Pay rates and exports are seen only by the firm's owner, an Office Administrator and an HR Manager; a person sees only their own leave balances; nobody else, and not TRACE staff outside a support window, sees any of it. Nothing is sent to a payroll provider.

October 8, 2026 (latest, after the overhead entry): Import your files is new. A firm can choose a folder on its own computer and have TRACE sort what is in it before importing anything. The folder is read in the browser and nothing is uploaded until Import is pressed; "What we collect" now describes the log each run keeps, which holds file paths, names, sizes and a few details read from each file but not the files' text. If your firm has AI on, a separate button can ask it for a second opinion on the files TRACE's own rules were unsure about: that sends our AI provider each such file's folder path and the first lines of its text, never the file, and only when someone presses the button. Anthropic's entry names it. Your primary user's AI switch turns it off.

October 8, 2026 (latest): a technician can now clock in on overhead, hours that belong to no job, as well as on a job. It follows the same switch as before: where your firm records where a technician is when they clock in, an overhead clock-in keeps the position the device reports while the shift is open and deletes it at clock-out; with no job there is no site, so no distance is worked out or kept. Training hours logged on overhead are approved by a colleague at the same firm who holds a current Level II or above in the method, and are recorded like any other approved training. A phone with no signal now keeps an overhead clock-in on the device, with the time it was taken (and the position only where your firm records it), until it can send it, and sends the clock-out the same way; "Where your data lives" now says so.

October 8, 2026 (later): Time now records a technician's hours on a job by method. For hours in a method the technician is not yet Level II in, which are on-the-job training, it also records what they did (for example prep, process, inspect, post, witness or read), the colleague they asked to approve it, that colleague's answer and any reason they gave, and the level and scheme of the certification they approved under. An approved line is added to the technician's training hours and, like all training hours, stays with them if their company moves to another firm. Your firm's office and the people you asked can see these lines; no one outside your firm can.

October 8, 2026: Chat is new, and "What we collect" now describes it. The people of one firm — its consultants and the technicians who have logins — can write to one another in channels and direct messages. Only the people in a conversation can read it; clients cannot see chat, TRACE staff cannot read it even during a support window, and an owner or office manager cannot read other people's direct messages. Messages are text only, are kept until someone removes them, and are deleted with the firm. They are not copied into the firm's change history. The first 140 characters of a message that rings someone's bell also appear in that bell and in the phone alert, so "Expo" now names the first part of a chat message among what a notification can carry.

October 7, 2026 (latest): Training now says what happens to a person's training records when the client company they work for moves to another firm: each record that still counts is copied to the new firm, with the person's own signature and the name of the firm that recorded it, and the previous firm keeps its own copy. The previous firm's private notes on a record do not go with it. If either firm later deletes its account, only that firm's copy goes.

October 7, 2026 (later): Anthropic's entry names one more AI feature. When your firm sets up printing its reports on its own paper form and the blank form it uploads is a scan, a person on your staff can have TRACE's AI read the scan's first page to propose where each value goes and to say whether anything is already written in. That page is sent to Anthropic to be read; what comes back is a proposal your staff check and save themselves. A form saved from Word or a PDF editor is placed without any AI. Like every other AI feature here, it spends your firm's own AI credits and stops when your primary user turns AI off.

October 7, 2026 (later): TRACE sets one more cookie, and the Cookie Policy lists it. Opening the QR code printed on a TRACE traveler (a job's work order) before you have signed in now sets a cookie called trace_return_to that remembers which traveler you scanned, so you land on it after signing in instead of on your dashboard. It holds that page's address and nothing about you, cannot be read by scripts, lasts at most fifteen minutes and is deleted when you arrive. That is why the notice at the bottom of the screen appears once more.

October 7, 2026: "Where your data lives" now says that a consultant can also make their own computer available offline, from Reports: it keeps the scheduled and in-progress jobs of the firm they are working in, its report forms, each job's crew with their certifications (names and certification facts only — no contact details, personal documents or rates), the firm's technique library and their own draft reports, encrypted under their offline passcode, and a report written there is filed only in that firm.

October 7, 2026: "Where your data lives" now says that a technician's computer made available offline also keeps their own draft charge sheets (hours and quantities, never prices), their own hours of the last two months and the name and logo of the firm their reports print under, and the charge sheets and hours they write with no signal until those reach TRACE — all encrypted under their offline passcode, as before. A DRAFT PDF of a report can be made there in the browser; it is marked as a draft on every page and is not stored by TRACE.

October 6, 2026 (latest that day): "Information we receive from Google" now describes the TRACE add-on for Gmail, which is built but not available to install until Google finishes reviewing it: the four permissions it asks for, that it reads only the headers of the email you have open and only while you use it, that it keeps which Google account you linked, and that it stores an email only when you press "Log this email" — the same thin record as the other ways of logging mail — kept, like mail logged from a Google mailbox, out of the support window your firm can open for our staff.

October 6, 2026 (later still): the signing-links paragraph now lists four more records a firm can send a link for — a safety talk's leader, a work permit's issuer, a radiographer's source log entry, and an employee's acknowledgement of a disciplinary action — and says what such a link shows: a talk's sign-in list by name, and a disciplinary action's kind, date and summary to the employee it is sent to. What is kept for each signature is unchanged.

October 6, 2026 (later): Training now says what happens when a firm moves a course to another part of its work: the records, assignments and attendance of that course move with it, nothing anyone signed changes, and the move is kept in the firm's audit log. Separately, a firm's published course now opens only for the people it reaches — those it is assigned to, or who fall under a path or rule that holds it, or who already have a record of it — rather than for everyone at the firm.

October 6, 2026: "Where your data lives" now describes offline field reports on the website. A technician can choose to make their own computer available offline; it then keeps a copy of their jobs, report forms and draft reports, and the reports and photos they write with no signal until those reach TRACE, all encrypted under an offline passcode they choose and TRACE never sees. The copy is deleted at sign-out, when someone else signs in on that computer, and after 14 days; unsent reports stay, readable only by their author, until they are sent or the author discards them. It is not offered to the demo workspace or to TRACE staff.

October 6, 2026: the Community section now describes the games leaderboard. If you play the free NDT games signed in, today's first finished puzzle in each game is kept with its score and time; you appear on the leaderboard only if you choose to, by your Community name or a leaderboard name you pick, never by email or company, and anyone signed in to TRACE can see it.

October 5, 2026 (later still): Anthropic's entry now names the Nadcap self-audit cross-check. When one of your staff runs it on a review, TRACE sends, for each YES a supplier backed with a procedure reference, the checklist question, the note the supplier wrote beside it, and the one paragraph of the uploaded procedure that note cites — never the whole procedure. The files uploaded to a review stay in your firm's private file storage at Supabase, with the review.

October 5, 2026 (later): a customer sign-off link — the one a firm emails or hands over on a phone so a customer can sign an inspection report or a charge sheet — no longer goes on showing that document once it has been signed or declined, or has expired. It shows only that it was signed or declined, and when, and where the signed copy is: the company's client portal, or the firm that sent it. The document's PDF is no longer served through the link either.

October 5, 2026 (later): the follow-up choices — the findings, an interview, being contacted — have been removed from every survey response sent before October 3, 2026. The people who asked for one were already in our CRM as leads, so nothing they asked for is lost, and no survey response now records what its sender asked for. Those older responses still carry the time they arrived, visible only to TRACE staff.

October 5, 2026: "What we collect" now describes calendar subscriptions — the private link your calendar app subscribes to, what its entries show, that anyone holding the link can read them, and that TRACE keeps only a fingerprint of the link and when it was last collected. The signing-links paragraph now covers every kind of record a link can sign, says the link shows that record's details only while it can still be signed and nothing of them once it is signed, withdrawn or expired, and corrects two claims that were too broad: an expired one-time code's scrambled form is not deleted the moment it expires but is discarded once used or replaced, and a signature given through a link appears on the record it signs, where whoever reads that record sees it — only the request behind it is limited to the firm's own staff. A new paragraph says how each signature in TRACE got there. The push-notification entry now says a notification carries the name of the firm it concerns. The survey paragraph now says that responses sent before October 3 still carry the time they arrived and which follow-ups were asked for, visible only to TRACE staff. The sponsor sentence now says a sponsor's logo is fetched from our file storage at Supabase rather than from our own site, and the Advertise sentence that an enquiry is also emailed to our marketing team. And the help desk sentence said those logins use the emailed second step every time; they must complete the second sign-in step, by whichever method they have set up. Three additions made on October 3 are recorded here because they had no entry of their own: signing links for people without a TRACE login, TRACE help desk logins (Security section), and a firm's IT contact reading the firm's support requests.

October 4, 2026: we added an Advertise page for companies that want to sponsor our free tools. What you send through its enquiry form — your name, company, email, what you would like to sponsor and your message — goes into our own CRM as a lead our marketing team follows up on, and its human-check is the same Cloudflare Turnstile the other public forms use. The free tools, guides and conference calendar can now show a labelled sponsor block; it sets no cookie, loads no third-party script, and sends nothing about you to the sponsor.

October 3, 2026 (evening): the email addresses typed into the survey's old optional box have been removed from every response sent before the change, so no survey response holds an email address any more. People who had asked for the findings, an interview or to be contacted were first added to our CRM as leads, with only their email and what they asked for.

October 3, 2026 (later still): new survey answers are anonymous for everybody, staff included. From now on they are stored with no name, no email address and no time of day — only the day they arrived; a response sent before today may still hold the address typed into the old optional email box, visible only to TRACE staff. If you ask for the findings, an interview or to be contacted, your name and contact details go into our own CRM separately, as a lead our marketing team follows up on, with what you asked for and never your answers. The survey no longer emails us about a follow-up request (notices sent before this change stay in our mailbox), and the giveaway paragraph no longer warns that the survey's email box could join your answers to your entry, because the answers no longer hold one.

October 3, 2026 (later): "What we collect" now says that TRACE's marketing team — the people in our TRACE Marketing workspace, who run the Certification Currency Survey for us — reviews individual survey responses: each one's answers, including the free-text answer, and the day it arrived. They never see the email address given, the contact choices, the time of day or the link a response came from, and nothing they see is linked to a giveaway entry. Published findings stay in aggregate, and free-text answers are quoted only anonymously.

October 3, 2026: "What we collect" now says who sees answers to our Certification Currency Survey. Individual responses are still read only by TRACE staff. The person who runs the survey's marketing for us, who is not on our staff, can now see the results as totals — how many chose each answer, and breakdowns by role that never show a group smaller than five — and never a single response, its time, its source, an email address or the free-text answers.

October 2, 2026: "What we collect" now also describes the state a person works in, whether they supervise, the state a job is worked in, and the radiographer cards a person holds — what each is, who sees it, and that deleting the person or the firm deletes it.

October 2, 2026: "What we collect" now describes three additions to Training. Training given in person is recorded as a session with an attendance sheet: who was there, who marked it, and the typed-name signatures of the instructor and of each person who confirms they attended. A firm can set continuing-education targets and see each person's progress from their training records. And a firm can put its own office staff on its training roster, which makes a training file for that person linked to their login. Who sees each, and that deleting the person or the firm deletes it, is set out there.

October 1, 2026: four changes to Training and certificates. A certificate — printed, or answered at www.tracendt.com/verify — no longer shows a person's email address when no name is on file; it says "Name not on file". A person reading their own training records, authorizations and auditor qualifications no longer sees the notes the firm's staff keep on them. A firm can now withdraw a single training certificate, and its code then answers only that it was withdrawn. And when a client company moves to a workspace of its own, its people's training records, authorizations and auditor qualifications now go with it, signatures kept and marked as copies.

October 1, 2026: "What we collect" now describes Training, which arrived today: a firm can assign its own people courses, TRACE notes which sections each person has opened so a course is signed only once it has been read, and signing keeps the name typed, the statement it was typed under, the time and the login. A signed or passed record cannot be changed or removed by the firm, and a client company that is shown its people's quality, safety or HR records sees their course, dates, hours, signed name and certificate code — not the score or the reading history. It also now describes the certificate check at www.tracendt.com/verify, which this policy should have described when it opened on September 13, 2026: anyone holding a test certificate's code can confirm the name on it, the test, the firm, the date, the score and the pass mark, and — only for a course its firm has opened to checking — a training certificate's name, course, firm and dates. Nobody can search by name; the check needs the code. And the API paragraph said a Free firm's keys work again once it is on "a paid plan"; it now names Plus, Pro and Enterprise, because an account that pays for a single module on its own is refused a key too, as the Terms already said.

October 1, 2026: "What we collect" said that each sign-in attempt is noted briefly — the address tried and the network it came from — and cleared after about an hour. The same brief note has always been made when any of our public forms is sent in: a survey response, a giveaway entry, a contact or lead form, a reply to an estimate or a request to sign off, a certificate check, a support chat. It is there for the same reason, holds the same two things and goes after the same hour, but it was described under a heading about signing in, which is the one place somebody with no account would never look. The sentence now says so. Nothing about what is kept or for how long changed.

October 1, 2026: the giveaway paragraph said your survey answers and your giveaway entry had nothing linking them. That was wider than the truth, and we would rather correct it before anyone has entered than defend it afterwards. The entry itself still carries nothing that says which answers were yours — a one-way token and the day it arrived, not the time, with neither record pointing at the other — but the survey has an optional email box of its own, and a respondent who fills that in and then enters with the same address has that address on both records. The paragraph, the Official Rules and the entry form now say so, and say that leaving the survey's email box blank keeps the two apart. Nothing about what we keep or how long we keep it changed; the promise was too broad.

October 1, 2026: "Data retention and deletion" now says that a file you choose can sit in a private holding area for a moment before TRACE has a record of it. On the forms that take a large file, your browser puts it into storage under your own account rather than sending it inside the form, and the server reads it or moves it from there and deletes the holding copy. This has been how uploads work since September 8, 2026 and this policy had not said so. Two things it says plainly rather than rounding off: our own staff are not granted that area at all, so a support window does not reach it — the only kind of file that is true of — and a file you chose and never submitted has nothing deleting it at that moment, so it is cleared the next time you upload something, once it is over an hour old. Deleting your account clears it too. Nothing changed about how uploads work; the policy was silent about a place your file passes through.

October 1, 2026: there is one more thing you cannot do with the demo workspace's shared logins. Since September 30 those logins — the one we publish and the demo client and technician logins beside it — cannot change or reset their password, for the same reason they cannot add an authenticator or a passkey: everybody looking around the demo signs in with them, so one visitor's new password locks out the tablet we take to trade stands and everyone after them. Unlike the other two, that one is checked when the form is submitted rather than refused by the database, and it is narrower: it reaches only those shared logins, so an account of your own that has been let into the demo keeps its own password. The Security section, the Terms and the Security page had all described this rule as two things rather than three.

October 1, 2026: "What we collect" now describes the TRACE API. Your primary user can make keys so that another program your firm runs reads your records, and writes them where you allow it, and the paragraph says which kinds of record a key can be given, that a document or a field report comes with a short-lived link to the file itself, and that a key given documents reaches the ones marked for your own consultants only — because a key acts for your firm. It also says what we keep about a key and its use: the key's name and readable prefix, never the key itself, and a record of every call with the network address it came from. Anything a key writes is in your change history under that key's name. The Security section's list of what our own staff see without a support window now names a key's settings, and the one thing on that list we can do rather than see — revoke a key, which only takes access away, and which we tell your primary contact about with the reason. Nothing about your records changed; this is a feature the Terms and the Security page described on the day and this policy did not.

October 1, 2026: there is now a second way records cross between consultancies, and it is not Community. A client whose program a firm has been keeping can move up to a workspace of its own, and its primary user can then give one named firm standing access as its Level III. While that grant stands, that firm's consultants read the client's own program — its technicians, their certifications, training and compliance items, its written practices, appointments, program documents and controlled procedures — and can deliver and approve documents, push revisions of their own documents, and sign the client's certifications, with the client's own certifying authority always signing last. They reach nothing else: no clients of the client's, no invoices or billing, no logins, no internal notes it keeps about itself, no document it marked for its own consultants only, and they can delete nothing. Only the client's primary user can grant it, either side can end it at once, it stops while either firm is deactivated, and it is written into the client's own history. The Security section said your records were invisible to every other consultancy with Community as the one exception; it now says this, and "Client and technician accounts" describes both the move and the grant. The rule is new, not newly disclosed — but the sentence it makes wrong was on this page the day it shipped, which is why this entry says so plainly rather than reading as a feature note.

September 30, 2026: "What we collect" now describes our referral program. A firm that referred you used to see only a count of the signups its code brought in; from the program's start it sees your firm's name, your plan status and when you were referred and first paid, and its primary user sees the credit your payments earned it and the amounts it was worked out from. The signup page now tells you who referred you. We also compare the two firms — email domains, shared people, and whether the same card paid for both — to catch self-referral; only our staff see the result.

September 30, 2026: sending your firm's mail from your own domain is live. This policy said it was built and not switched on — true when it was written, and it stopped being true on September 24 when the key behind it was set, which nothing in the text could notice. Your primary user enters the domain on the Account page, TRACE registers that name with Resend, our email provider, and shows you the DNS records to publish; once they are in place your firm's mail leaves from your address rather than ours. Nothing new receives your mail — Resend already sent it — and registering a name gives neither TRACE nor Resend any way into mail at your domain.

September 30, 2026: a Word document you file can now carry a PDF copy of itself, so that what TRACE shows on screen is the document as Word would print it rather than a reconstruction of its text. "Data retention and deletion" and the Security section now account for it: it is a second stored file, it sits in the same private place under the same rules as the original, deleting the document deletes both, and Download still hands over the file you uploaded. Making one is not something the application does: our own staff run the conversion, using Word itself on their own machine, which is why the paragraph below on the keys that run the service now names that kind of work instead of leaving it to be assumed.

September 30, 2026: the Security section's list of what the service's own keys are used for said backups, database changes, scheduled jobs, and an import or repair your firm asked for. It left out maintenance we decide on ourselves — a conversion or a correction run across filed documents, which is how the PDF copies above were made. That work reads your files. It has always been within what those keys can do, and the list should have said so rather than reading as though everything outside it was impossible. Nothing about who holds a key or what the support window governs has changed.

September 30, 2026: three smaller corrections. The Terms now list the AI feature that drafts a TRACE form from one of your own form documents, which this policy named on September 29 and they did not. The Security section's note about the read-only demo workspace said the second sign-in step is skipped only for a login that belongs to no real firm; it is skipped whenever the workspace you are working in is the demo, which matters to the few people who have both, so it now says that. And previewing a Word document through its PDF copy was not being written into the record of who opened which document; it is now.

September 30, 2026: "What we collect" now describes our survey giveaway. If you enter it — after the Certification Currency Survey, or on the free entry page with no survey — we keep your name, email address, the day you entered and how, use them only to run the drawing and contact the winner, and delete them 90 days after the drawing. TRACE news only if you tick a separate box. Your survey answers are kept apart from your entry and are not linked to it.

September 29, 2026: Anthropic's entry names a new AI feature. A firm can point at one of its own form documents — the Word original, or the scan of the paper sheet its register controls — and have TRACE draft the matching form from it. That document is sent to Anthropic to be read, the same way a document you ask for a summary of is. What comes back is an unsaved draft: your staff read it and save it themselves, and nothing is written to your records until they do. Like every other AI feature here, a person on your staff starts it, it spends your firm's own AI credits, and it stops when your primary user turns AI off.

September 29, 2026: a new section, "Information we receive from Google", linked from the top of this page, sets out what TRACE receives when you sign in with Google or connect Gmail — the exact permissions, how the information is used, stored and shared, who can read it, and how to stop and delete it — and states the Google Limited Use commitment in full; until now it was one sentence inside the Email section. Two things changed with it. Mail logged in the CRM from a Google mailbox is now kept out of the support window your firm can open for our staff; and "Logging mail in the CRM" now says plainly that for a Google mailbox it is not offered yet, and that the preview line it keeps is part of what is read. We also completed the list of what our staff can see about an account without a support window: which modules it has and whether it pays for them, and how many of its sign-in accounts have signed in lately, which a business summary for our own staff has shown since September 28.

September 28, 2026: "Where your data lives" now names everything the phone app keeps on the device while it has no signal. A technician can now start and fill in a field report with no signal, so the phone keeps the report and its photos until it sends, and keeps a copy of the jobs and report forms they can report on — each job's customer, site, purchase order and equipment — so a report can be started in a place with no bars. Hours and receipts made offline, which had joined on September 27, are named there too. Signing out still forgets the copies and keeps only unsent work, marked as its author's.

September 28, 2026: "What we collect" now describes FAA mechanic certificate tracking, which arrived on September 27 for firms that employ aircraft maintenance technicians. It is off until a firm switches it on. It keeps each mechanic's A&P certificate — the number if you enter one, the ratings and the dates the FAA's recent-experience rule turns on — and any Inspection Authorization with its renewal activities and evidence. Because older FAA certificate numbers are the holder's Social Security number, the number is optional and only your own staff and the mechanic can see it: a client portal, a reminder and the calendar never show it. We also narrowed one sentence that said more than we meant: a vendor record will not store a full Social Security or Employer Identification Number, which is what the policy always described; it said "TRACE" where it meant that record.

September 27, 2026: the hourly security watch learned three things, and two of them change what this policy has to say. While you are signed in to the website we now note, at most once an hour, the approximate place your network address points to — country, region, city and a rough latitude and longitude, worked out by our hosting provider from the address, never taken from your device — and keep it for 90 days, so we can notice one account used from two places too far apart to travel between. When that happens you get an email, and so does your firm's primary user. And your firm now sees its own share of what the watch notices, on the Account page, for its primary user and the consultants that person chooses. The third needs no disclosure but is worth saying: the sign-in emails now carry a "this wasn't me" link that signs the device out. "Sign-in and device records" and "Watching our own logs" say all of this.

September 27, 2026: the one rule TRACE enforces about what you may do with your own sign-in is now described by what it actually applies to. Since September 23 a login belonging to our demo workspace cannot add an authenticator, and since the day after, a passkey. This policy, the Terms and the Security page all called those "the shared logins of the demo workspace", meaning the one account we publish. What the database keys on is a login that belongs to the demo workspace and to no real firm — so it also reaches an account that has only ever been let into the demo to look around, which is a person reading their own account page and finding the button refused. All three pages now say so, and say that joining a real firm brings both back. The rule has not changed; it was described more narrowly than it is enforced, and by the half nobody would have run into.

September 27, 2026: two things this policy described more narrowly than we do them. "What we collect" now says that a task board can have an email address of its own, so mail sent to it becomes a card on that board — that has been true since September 4 and this policy had never mentioned it. And the paragraph about mail we set aside because it cannot be filed named only a reply address matching no deal; it also covers a board address with nowhere to file a card, and an emailed answer to one of our own support replies that we will not file — one from a different address than the request came from, or one answering a request already closed. What is set aside is the same thin record it always was, it still belongs to no account, and it still clears itself after 90 days. Nothing changed about what happens; two sentences were describing one of three lanes.

September 27, 2026: the body of this policy now says what a support request holds, rather than leaving it to the change note below. It names what a ticket keeps — your name, email and message, the business you gave, which of our staff has it, whether it is open or answered, and every reply on either side — that a request you sent signed in is yours alone to read under My requests, and that our support staff read it without your firm opening a support window, because a message addressed to us is not one of your records and the alternative is being unable to read a request for help from somebody who cannot sign in. The Security section's list of what we can see without a window says so too. Nothing changed about who can read what; the plain statement was in the wrong place.

September 27, 2026: TRACE now sets one more cookie, and the Cookie Policy lists it. Everyone can choose Light, Dark or System on their Account page, and this device's copy of that choice is kept in a cookie called trace-theme — one word, nothing about you, no access of its own. It has to be a cookie rather than something tucked away in your browser's own storage, because the page has to be drawn in the right colour before any script runs, and only the cookie reaches our server in time for that. The choice is also saved on your account, so it follows you to another device. That takes the complete list from seven to eight, which is why the notice at the bottom of the screen appeared once more: the Cookie Policy promises you are told rather than left to notice.

September 26, 2026: a support request is now a ticket. Our replies and yours are kept in TRACE as one conversation, which you can read under My requests on the Help page when you sent it signed in, and an emailed answer to our reply reaches it through the same reply-capture service that files deal email. Only you and TRACE's support staff can read it. It is the same correspondence this policy already said we keep — now in one place rather than only in our mailbox.

September 25, 2026: our Certification Currency Survey now uses Cloudflare Turnstile, the same human-check that already guards signups, our contact form and lead forms — its entry says so, and so does the line about what a public page loads. One more surface for an existing subprocessor, no new data collected.

September 24, 2026, later the same day: two things this policy already described got wider. A charge sheet now adds a mileage line for each day a technician clocked in on a job, and to get the road distance it sends Google's routing service two addresses — the location that technician works out of, as your firm recorded it, and the job's site. Until now this policy said addresses went to Google only when someone planned a day's route. It is still only addresses: no names, no job, no hours. And invitations — to join your firm, your client portal, or a technician's own record — now go out under your firm's name the way estimates and invoices do, which means through the inviter's own mailbox if they have connected one. The Email section says so, including that the invitation's sign-in link then sits in that person's Sent folder. No new company receives anything.

September 24, 2026: nobody can add an authenticator app to the shared logins of our read-only demo workspace any more, and the Security section no longer says two-factor is available on every account. Those logins are shared between everyone looking around the demo, so an authenticator set up on one would ask every other person for a code only the person who set it up has — including the tablet we take to conferences. Refusing it is now enforced in the database rather than left to nobody thinking of it. It applies only to a login that belongs to the demo workspace and to no real firm: if you are a customer who switched into the demo to look around, your own authenticator is untouched, and a login that later joins a real firm stops being caught with nothing to do. Later the same day we did the same for passkeys on those logins, for a smaller reason: a passkey cannot lock anyone else out — it only adds a way in — but it would have let one visitor keep their own way into the shared demo, and that is not something we want left behind on an account we take to conferences. Passkeys on every other account are untouched. This is the one thing in TRACE that tells you what you may not do with your own sign-in, which is why it is written down here rather than only in the code.

September 23, 2026: recording where a technician is when they clock in is now off unless your firm turns it on. It had been on for every firm using Projects since September 13, which yesterday's entry disclosed; the day after disclosing it we made it a decision instead. Only your consultancy's primary user can switch it on, from the Account page, and while it is off nothing is asked for and nothing is stored — the database throws away a position even if a device sends one. Nothing already recorded was deleted: a position on a shift that is still open goes when that shift clocks out, as it always did. The laws on recording where an employee is differ from state to state, which is why this is a switch rather than a default. "What we collect" says what it keeps, who can see it, and how long, and the Terms say the decision and the notice you owe your technicians are yours.

September 22, 2026: "What we collect" now says that clocking in on a job records where the technician is. It has done since September 13 and this policy had never mentioned location at all, which is the worst way for a page like this to be wrong — not a word doing too much work, but a whole kind of record missing. What happens is unchanged: the device asks permission, a refusal still clocks you in and records nothing, the position is kept only while the shift is open and deleted at clock-out, and what stays with the hours is how far from the job's site address the shift began. It is asked for at the moment you clock in and at no other — in the browser only your own record and your dashboard may ask, on the phone only while the app is open — with no tracking in between and no route, and it never blocks a clock-in. The Terms say, as they do for everything else your firm chooses to keep about its people, that the decision to record it is your firm's.

September 22, 2026: two sentences about signing in with Microsoft caught up with the button. Signing in that way has worked since September 20, and it starts the same way Google's does — so it sets the same one-time sign-in cookie, and a brand-new account setting up its workspace afterwards goes through the same Cloudflare bot check. The Cookies section, Cloudflare's entry and the Cookie Policy named Google alone. No cookie was added and nothing new is sent anywhere; two lists were one item short.

September 22, 2026: misdirected mail now has the clock yesterday's entry said it did not. Quarantined messages are deleted automatically 90 days after they arrive, which is the number the owner chose: long enough for somebody who notices a reply never came to ask us to find it, short enough that it is not a standing collection of other people's correspondence. "What we collect" and "Data retention and deletion" both say so. The two messages our service has ever set aside arrived in August and will clear in November. You can still ask us to delete one sooner.

September 21, 2026: this policy said mail that arrives at a reply address matching no deal is "held briefly". Nothing prunes it, and the two such messages our service has ever received have been sitting there since August. Rather than leave a word doing work it can't, "What we collect" now says what is actually set aside — who it came from, who it was addressed to, the subject, and a reference number for the copy our delivery provider holds, but not the message itself — that it belongs to no consultancy so no account can reach it, and that there is no clock on it until we put one there. "Data retention and deletion" lists it as a fifth thing that outlives deleting an account, for the same reason the messages you send us are already on that list: it was never inside an account for a deletion to reach. Ask us and we will delete it. Nothing changed about what is kept; the policy described a shorter life than the code gives it.

September 21, 2026: any of your consultants can now open the support window that lets TRACE staff read your records — until September 19 it was your primary user alone, and the Security section still said so. The change is the firm's, not ours: the person actually stuck with the problem had to find a colleague before we could look. Nothing else about the window moved. We still cannot open one ourselves, it is still four or twenty-four hours, it still closes on its own, we can still close it early and never extend it, and it is still written into your own audit trail — which now names whichever consultant opened it. The database enforces who may open one, not the page. If you would rather it were the primary user's alone, tell us.

September 21, 2026: about ten days in, a new firm's primary contact gets one note suggesting modules that fit their work. It shipped on September 20 and the Email section named it the same day, but two things about it were not said and are now. It is the only message TRACE sends whose whole purpose is telling you about something for sale, so it belongs in the paragraph about mail that talks about us rather than in the list of account mail — and the Account page's digest switch turns it off, which the note itself now says. And it is reasoned from counts of your own records, so the Security section's list of what our side can see without a support window now names those counts: how many technicians, certifications and compliance items you have entered, and the methods and programmes your companies are marked with. Nobody reads them; a scheduled job counts them and writes to your own primary contact. The setup note in the first week sells nothing and is unchanged.

September 21, 2026: signing in with a Microsoft account works. The entry below, written on September 19, said the button was there but the connection behind it was not switched on; it was switched on the following day, and this page said otherwise until now. Nothing about what Microsoft is told changed — it verifies who you are and passes us your name and email address, the same as Google's sign-in — and signing in with a password, a passkey or Google is unaffected. The subprocessor list already named Microsoft and still does.

September 19, 2026: customers can now sign off on an inspection report or a charge sheet — on the technician's phone while they are still on site, or from a private link emailed to them — and "What we collect" says what that keeps. A handwritten signature is the most personal thing in TRACE that does not belong to a customer of ours, so the paragraph names all of it: the name and job title typed in, the drawn signature kept as an image in the same private storage as every document, the date and time, and the network address and browser it was signed from, which is what makes a signature placeable later. A rejection keeps the reason instead. It also says what the link is, checked against the code rather than the description: whoever holds it can read that one document, an unanswered one expires sixty days after it was sent or last changed, and an answered one cannot be signed again but goes on showing the document to whoever holds the link. The paragraph about people who send information to a firm through TRACE now covers the person who signs, too, because they are in the same position — not our customer, no account, and the firm that asked for the signature is responsible for it. The Terms say the same in section 5.

September 19, 2026: a "Continue with Microsoft" button appeared beside the Google one on the sign-in box and the signup page, and Microsoft was not among the providers this policy lists. It is now, saying what Google's entry says about the same lane — if you use it, Microsoft verifies who you are and tells us your name and email address, and nothing else — and saying plainly that the connection behind the button is not switched on yet, so it does not work today and nothing reaches Microsoft through it. Connecting your own Microsoft 365 mailbox, which is live, is a different thing and is described in the Email section, where it already was.

September 19, 2026: a password you choose is now checked against a published list of breached passwords, and refused if it is on one. The Security section says how that is done without your password leaving our server: it is scrambled one way and only the first five characters of the result are sent, so the Have I Been Pwned service sees no password, no account and nothing identifying you, and the comparison happens here. New disclosure for a new check; nothing about existing passwords changed, and if the service is unreachable your password is accepted rather than blocked.

September 19, 2026: TRACE now reads its own logs every hour and speaks up, and the Security section has a paragraph saying so. Nothing new is recorded about what you do — the change history, the document-access log and the sign-in records all existed already — but until now nobody read them unless something had gone wrong. Two things are new and are disclosed here because they are: your account gets an email from us if it is signed in to from a network address it has never been used from, which means we keep a list of the addresses and device kinds each account has signed in from for as long as the account exists, and "Sign-in and device records" said those were cleared after an hour, which was true of a different record and not of this one. And a short list of patterns — one login opening sixty documents in an hour, one person deleting twenty-five records, a role or primary-user change, someone joining or leaving a firm, a support window opened — raises a note to our own staff outside the support window. The Security section says plainly what that note contains: a name, a firm and a count, never a document or a record. Nothing about who may read your records changed.

September 19, 2026: "What we collect" now says who can read a comment. Threads replaced the last of the "Internal notes" boxes this week, including on four records in Ledger that never had one, so a comment is now the place your team's private working notes actually live. The policy had listed comments among the things TRACE holds since the beginning and had never said who sees them. It now says what has always been enforced: a thread is for your own staff, and no client login and no technician login can read one on any record, including a record they can otherwise see. That is refused by the database rather than hidden by a page. Nothing changed about who can see what; the policy was silent where it should have been plain.

September 19, 2026: connecting your own Google or Microsoft 365 mailbox is live. This policy said it was built but not switched on, and that no one could connect a mailbox today — which was true when it was written and is no longer. Nothing about the connection changed: the access asked for still only sends mail as you and tells us which address that is, it still cannot read, search or list your mail, and we still store your address and that access encrypted and nothing else. What changed is that you can now actually do it, so the sentence saying you could not is gone, and the Terms say the same. One thing added while we were there: a mailbox belongs to you at one firm, so if you work with more than one you connect each separately, and leaving a firm removes the one you made there. Connecting QuickBooks, sending from your firm's own domain, and taking client payments through your firm's Stripe account are all still built and not switched on.

September 19, 2026: Ledger grew a bank and card register — you set up an account, import a statement, and match its lines against your invoices and expenses — and receipts are captured against an expense. That is your firm's own financial data, and "What we collect" ended its money sentence at "invoicing", which is what the module was before. It now has a paragraph of its own saying what is held: the account's name and kind, the balance you opened it at and the last four digits if you enter them; and per statement line the date, the bank's own description, the amount, any reference, and what it was matched to. It says what cannot be held — the database takes four digits and no more, and there is no field for a full account or routing number — and that the statement file you upload is read and discarded rather than stored, while receipts are kept as ordinary documents with no reading of the figures off the picture. It also states what was true and unsaid: none of it is visible to a client or technician login, and none of it goes to an AI model. Stripe's entry and the Security page said "card and bank numbers never touch TRACE", which was a sentence about paying; both now say that plainly, because your own account's last four can now be typed in by you.

September 17, 2026: Stripe's own billing page opened to customers, so Stripe's entry and "Billing status" now say that it holds more than the card. The billing name and email, the address, a phone number and a tax ID — the details printed on an invoice — are entered on Stripe's page and held by Stripe, not by us, and past invoices and receipts are downloaded from there. Nothing moved: those details were always Stripe's, and this policy named only the card.

September 17, 2026: "Where your data lives" now has a third footnote, about the phone app. It had never been in that section at all, and the app keeps a little on the device so it works where there is no signal — a tool check or source check-out made offline, waiting to send, and the last copy it saw of your name, your role and the source log. It sits in the app's private storage, goes when the app is uninstalled, and stays through a sign-out. Nothing changed about the app; the policy had been silent about it.

September 17, 2026: the limit on the support-window promise, added on September 15, named the nightly backup, database changes, the scheduled jobs and imports you ask us for. It left out the plainest case: the application itself holds one of those keys and uses it for parts of ordinary work you do in TRACE, where a step has to touch something your own sign-in is not allowed to reach. The Security section and the Security page now say so, and say that the code has to make the same check the database would have made there. Our September audits found two places where it did not — a read-only account could write through one of those doors — and both were fixed the day they were found. Nothing changed about how we work; the limit we stated was narrower than the truth.

September 17, 2026: "Data retention and deletion" said that after we delete an account the only thing we keep is a content-free note that it existed. That was not the whole truth, and this policy contradicted it two sections earlier. Four things outlive a deletion, and the section now lists them: that note; anything you posted in Community, which stays under the name you posted it with; a tally of AI requests with the consultancy and the person stripped off it; and the messages you sent us through the contact form, the Help form or support, which are our correspondence rather than a record in your account — ask and we will delete those too. The section also now says plainly that we do not reach into a backup to cut one account's rows out of it, and names our database provider's own seven-day rolling backups alongside the offsite copies already described. Nothing changed about what we delete; the promise was stated more absolutely than we keep it.

September 17, 2026: the Cookies section said the one cookie someone who is not signed in can get is the one set when they start a test from a share link. Signing up, asking for a password-reset link, or choosing to sign in with Google also sets one before you are signed in — a one-time value that lets that sign-in finish, already listed in the Cookie Policy. The section now says so. No cookie was added; the policy described one fewer occasion than there is.

September 17, 2026: Stripe's entry in the list of providers now says, as the rest of this policy already did, that a firm connecting its own Stripe account for client payments is built but not switched on yet. Nothing about how your data is handled changed.

September 15, 2026: the Security section now states a limit on the support-window promise that it had left the reader to guess at. The window governs TRACE staff reading your records through the application, and the database enforces it. It does not govern the keys that run the service — the nightly backup, a database change, the scheduled jobs, an import you ask us to run — which cannot be subject to the access rules and are held by the people who operate TRACE. Nothing changed about how we work; the page was stating an absolute where the truth is narrower.

September 15, 2026: HR Records gained three registers on September 15 — the cards and licences a technician needs to get on site, screenings, and disciplinary records — and "What we collect" now describes them instead of folding them into "personnel and HR records". The screening entry is deliberately thin: TRACE records that a drug test, alcohol test, background check or physical happened and whether your firm cleared the person, and has nowhere to put what was tested for or what the report said. Disciplinary records are visible only to your own staff with the module — not to a client login, and not to the technician they are about. New disclosure for a new feature, and a category of record sensitive enough to name on the day it ships.

September 14, 2026: part of your change history was not labelled with your consultancy — the history of exam answers, safety-meeting attendance, controlled-document acknowledgments and revisions, specimen indications, and three kinds of quality record. That broke two promises made here in the entries below: TRACE staff could read those rows without a support window, and deleting an account left them behind. Now every such row carries its consultancy, so the support window governs it and deleting the account deletes it. Older rows that could be traced to their consultancy were labelled. Rows whose record had already been deleted, and which could not be traced to any consultancy, were deleted — they were left over from deleted accounts and from our own test runs. This fixes how two existing promises were kept; the promises themselves haven't changed.

September 14, 2026: Anthropic's entry now names the QMS module's root-cause helper, which shipped on September 13 without being listed. When one of your staff asks it about a finding, it sends that finding's description, its source and severity, whatever the finding already records about containment, correction, root cause and corrective action, and the name of the company it is about. It writes nothing: your staff copy what they want into the finding and save it themselves. It stops when your primary user turns AI off. New disclosure for a feature that should have been named the day it shipped.

September 14, 2026: the paragraphs on your firm's own Stripe account, QuickBooks Online, your own mailbox and your own sending domain now say plainly that all four are built but not switched on yet, so no firm can use them today. They described what happens when a firm turns them on without saying that none can. Nothing about how your data is handled changed.

September 14, 2026: creating a new workspace after signing in with Google now goes through Cloudflare Turnstile, the same human-check as signing up with an email address. Signing in with Google to an account that already exists still does not use it. Cloudflare's entry says so. One more surface for an existing subprocessor, no new data collected.

September 13, 2026: "What we collect" now says that vendor records can note who gets a 1099 and whether a W-9 is on file, and hold at most the last four digits of a tax ID. The database refuses anything longer, so a full Social Security or Employer Identification Number cannot be stored.

September 13, 2026: Anthropic's entry now names a third Certification Testing feature: drafting a translation of a test's questions into another language. It sends the question as written — its text, answer choices, explanations and accepted answers — and nothing about any candidate. A translation stays a draft until someone at your firm who reads the language approves it, and the feature stops when your primary user turns AI off.

September 13, 2026: the Cookies section now mentions the short-lived cookie set while you connect QuickBooks Online or your own mailbox, and the Cookie Policy lists both by name. They shipped with those features without being listed; each lasts ten minutes and only checks that the connection coming back is the one you started.

September 13, 2026: added what happens if your firm turns on online payments. If your primary user connects the firm's own Stripe account, your clients can pay an invoice on Stripe's checkout page, straight into that account. "What we collect" and Stripe's entry now say who the seller is (your firm), that TRACE takes no fee and holds no money, and what TRACE records about each payment — amount, date, card brand or bank name with its last four digits, and Stripe's reference. Full card and bank numbers still never reach TRACE. Nothing happens unless your primary user connects Stripe.

September 13, 2026: the Email section now covers two changes to how your firm's mail leaves TRACE. With no setup at all it arrives as "Your Firm via TRACE", with replies going to you. And it describes what happens if a consultant connects their own Google or Microsoft 365 mailbox, where TRACE offers that, so their mail goes out from their own address: the section says what that access can and cannot do (send only, never read), what we store (your address and the encrypted access), that those messages go to Google or Microsoft rather than Resend, and how to disconnect. Nothing is sent through a mailbox unless its owner connects it.

September 13, 2026: Anthropic's entry now names the two AI features Certification Testing gained on September 12 — drafting test questions from a document your firm holds, and suggesting a mark for a candidate's essay answer. Both are started by your staff, both are drafts a person decides on, and both stop when your primary user turns AI off. A suggested mark sends the question, its model answer and the candidate's answer, not the candidate's name. New disclosure for a new feature; it should have been named the day it shipped.

September 13, 2026: the Email section now covers two new options, both off until your primary user turns them on: sending your firm's estimates, invoices and deal emails from your own domain, and payment reminders TRACE emails to an unpaid invoice's recipients on your firm's behalf. Resend delivers both, as it does the rest.

September 13, 2026: "What we collect" now says that a test can be set to use the camera, and that when it is, the candidate's photo holding their ID and a still every few minutes are kept with the result. The feature has existed since September 4; this policy had not said it keeps photographs of people.

September 13, 2026: the Security section said two-factor authentication was required on consultancy staff accounts only. Since September 12 client-portal logins take the same second step on every sign-in, and a consultancy can require it of its technicians. A strengthening the policy had not caught up with.

September 13, 2026: added what happens if your consultancy connects QuickBooks Online — which records TRACE sends to your own QuickBooks company, that it reads nothing back but the company's name and product list, and that the access is stored encrypted and revoked when you disconnect. Nothing is sent unless your primary user connects it.

September 12, 2026: signing in with a password, and asking for a password-reset link, now go through Cloudflare Turnstile — the same human-check that already guards signups, our contact form and lead forms. Its entry says so, and so does the line about what a public page loads: the check opens with the sign-in box. Signing in with a passkey or with Google does not use it. One more surface for an existing subprocessor, no new data collected.

September 12, 2026: Google's entry now names a third use — TRACE's own email. Since September 11 our addresses (support@, sales@ and the like) are Google Workspace mailboxes, so mail you send them, the copy of each message sent through our contact form or the in-app Help form, and our own notices about account events (such as a new signup) are kept there. Nothing about your records changed; this is where our correspondence with you is kept.

September 12, 2026: Anthropic's entry now says how long it keeps what TRACE sends — its published policy for API customers is 30 days, longer only for requests its Usage Policy flags (up to two years) or where the law requires — and that we have no zero-data-retention agreement with it. It also names a new control: your consultancy's primary user can now turn AI off for the whole consultancy from the Account page, which stops the AI features and the support chat for everyone who works in it, TRACE's own staff included. Until now, turning it off took a request to us.

September 12, 2026: deleting an account now also deletes its change history and its record of who opened which document. Until now both logs kept copies of your records after the account was gone, which did not square with deleting "your account and its data". What remains is a note that the account was deleted, when and by whom, with no names and no contents.

September 11, 2026: four corrections from an accuracy audit, none a change in practice. "What we collect" now says that sign-in attempts are noted briefly, with the network address they came from, to throttle password-guessing, and that the mobile app keeps a push token per device. Expo's entry now says a notification also carries the record references the app needs to open it. The line about browsing leaving no trail now names the one outside service a public page loads — Cloudflare's bot check on the home page's contact form. And the Email section now lists the confirmation link sent when you sign up.

September 11, 2026: TRACE staff can no longer read a consultancy's change history, or its record of who opened which document, without a support window. Those logs hold the contents of the records they track, so reading them was a way around the window this policy describes; now the window governs them too. The record of when support access was opened and closed stays visible to our staff, because that is what support is accountable to.

September 11, 2026: this policy said TRACE sends operational email only. That wasn't accurate: a consultant's digest can close with a feature tip or an add-on and its price, the welcome email on a Free account mentions the paid plans, and the trial emails say what keeping a module costs. The Email section now lists what we actually send, says which of it talks about TRACE itself, and names the two emails you can now switch off. Who we email hasn't changed; the policy described less than we send.

September 8, 2026: this policy promised to name the offsite backup bucket's region once we had confirmed it. We have, so it now says: Cloudflare R2, Eastern North America — and says plainly that we are not rounding that up to "the United States", because it is a placement hint and eastern North America includes Canada. The backup has always been encrypted before it leaves us with a key Cloudflare does not hold. Nothing moved; a promise came due.

September 7, 2026: named two more providers this policy had not been listing — Cloudflare R2, which holds the nightly offsite backup encrypted with a key it does not have, and GitHub, whose scheduled jobs take that backup and restore it to prove it works. Both were already in our internal subprocessor record; the public list here had not caught up. Nothing about how your data is handled changed — this is disclosure of two we should have named already.

September 6, 2026: Day Routes can now ask Google for real driving times between a day's job sites, so Google's entry names that second use and says exactly what is sent — the site addresses for that day, and nothing else about the work or the people. New disclosure for a new feature.

September 4, 2026: the contact form on our homepage now uses Cloudflare Turnstile, the same human-check that already guards signups and lead forms — its entry says so. One more surface for an existing subprocessor, no new data collected.

September 2, 2026: the in-app support chat runs on Anthropic, so its entry now says so — the chat sends only what you type plus our own FAQ, and cannot read your records. Disclosure for a new lane, not a change to an existing one.

August 28, 2026: noted that a referral code entered at signup records which firm referred you, and that the referrer sees only a count — new disclosure for a new feature, nothing retroactive.

August 25, 2026: the CRM gained two ways for other people to send information into a consultancy's account — a lead form and a per-deal reply address — so this policy now says that TRACE holds data about people who never signed up for it, who is responsible for that data, and that Resend receives mail as well as sending it. New disclosure, not a new practice we had been keeping quiet.

August 23, 2026: added a section saying where your data is hosted — the United States, US East — which this policy had never actually stated. No change to where anything lives; the policy simply had not said it.

August 22, 2026: TRACE now also keeps a record of who opened or downloaded each document, and when, alongside the existing record of who changed what. That is a strengthening of the audit trail, noted here because it is a record about identifiable people.

August 22, 2026: spelled out that the modules hold more than the original list said (safety and radiation, HR, equipment, quality-system, projects, invoicing), and that some of what TRACE keeps is a record of who did what — appointments, signatures, who administered an exam, who changed a record. Both were already true; the policy described a smaller product than the one you're using.

August 21, 2026: named two providers this policy had not been listing — Anthropic, which powers AI Assist, and Google, for accounts that sign in with it — and added the section describing the Community area, the one part of TRACE that is shared across consultancies. Both were already true of the product; the policy had not caught up with them. Disclosure added, nothing about how TRACE handles your data changed.

August 8, 2026: two-factor authentication became required on consultancy staff accounts (emailed one-time codes by default, authenticator app optionally). A strengthening, not a weakening.

August 2, 2026: split the cookie details into a standalone Cookie Policy listing every cookie by name, and added the on-screen notice pointing to it. No change to what TRACE actually sets.