What we store
PublicTrace stores three things tied to your account: your email address, your name and (optionally) your company name, and a salted SHA-256 hash of each API key you create. We never store API keys in cleartext — once a key is shown after creation, the cleartext is gone. If you lose a key, you revoke it and create a new one.
The data you query comes from 27 public US government databases. It is primarily organizational, but some records identify individuals in their official or regulated capacities — corporate officers named in SEC filings, sanctioned individuals on the OFAC SDN list, excluded providers on the HHS-OIG exclusion list, federal lobbyists registered under the LDA, and parties to federal court dockets. These are public by operation of federal law. We do not receive or store personal information about you beyond your PublicTrace account, and we do not receive or store any information about your end users.
Encryption
All API requests are served over TLS 1.2+. The server only accepts modern cipher suites (HSTS, no RC4, no weak DH). Cookies that authenticate your browser session (access_token, refresh_token) are flagged HttpOnly, Secure, and SameSite=Lax. Stored data is encrypted at rest using managed AES-256 encryption.
Authentication
We use passwordless email-based authentication. There are no passwords to leak, reuse, or phish. To sign in, you enter your email and we send a one-time 6-digit code that expires in 10 minutes. API access is gated by API keys you generate yourself; the key prefix is shown in your dashboard, and the cleartext is shown once at creation time.
Application security
Our development process addresses each category of the OWASP Top Ten 2021 during code review and dependency scanning. We do not currently hold a third-party penetration-test attestation; one is on our 2026 roadmap. Specific controls in production:
- CSRF tokens on all state-changing browser requests.
- Strict input validation at each API boundary; SQL queries use parameterised statements (no string concatenation).
- Stripe webhook signatures verified before any subscription state change.
- Rate-limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset) returned on each response. Per-plan rate-limit enforcement is in active rollout; plan quotas are enforced at the billing layer today.
- Dependency scanning on each push; CVE-flagged libraries are updated within a week of disclosure.
Reporting a vulnerability
If you find a security issue, please email [email protected]. We respond within 48 hours and work with you to fix the issue before any public disclosure. We don't yet have a paid bug-bounty program, but we will publicly credit responsible disclosures (with your permission) on this page.
Safe harbor. Researchers acting in good faith under this policy — no data exfiltration, no social engineering of staff, no denial-of-service testing — will not be the subject of legal action by PublicTrace, including under the Computer Fraud and Abuse Act (18 U.S.C. §1030) or equivalent state statutes.
Please do not use the public contact form for security reports — that channel is unencrypted and not monitored at the same priority.
What's not in scope
We don't provide custody of customer-supplied PII, payment data (Stripe handles cards directly via Stripe.js — we never see card numbers), or PHI. If you build a product on PublicTrace that handles regulated data downstream, the security posture of that product is your responsibility.
Compliance posture
We do not currently hold SOC 2 Type 1/2, ISO 27001, HIPAA BAA capability, or FedRAMP authorization. SOC 2 Type 1 is targeted for H2 2026. We state this plainly so security reviews begin with the actual posture.
PublicTrace is not a HIPAA Covered Entity or Business Associate — the healthcare-adjacent records we serve (HHS-OIG exclusions keyed by NPI) are public federal data, not PHI. We can share a CAIQ-Lite self-assessment on request.
Subprocessors
- Cloudflare — edge network, DDoS mitigation, and TLS termination for publictrace.dev.
- Stripe — payment processing. Cards never touch our servers. EU–US DPF certified.
- SpaceMail (Namecheap Private Email) and Amazon SES — transactional email (login codes, account and alert notifications).
- Third-party AI providers — embedding and LLM inference for entity resolution and AI features. Query text may be sent to these providers; customer account data is not. Named providers are disclosed in the DPA / on request.
We will give 30 days' notice of material subprocessor changes via the dashboard and (for enterprise customers) by email.
Not a consumer reporting agency
PublicTrace is not a consumer reporting agency under the Fair Credit Reporting Act (15 U.S.C. §1681a). Our data is not a consumer report and may not be used for employment, credit, insurance, housing, or government-licensing decisions about individuals. See our Terms §3 for the full scope of acceptable use.