ONTRACE.AI
ONTRACE.AI
Security

How we secure ONTRACE itself.

An ISMS platform that doesn't secure its own infrastructure isn't an ISMS platform — it's a liability. Here's how ONTRACE.AI secures the platform you trust with your security management data.

Defence in depth
Least privilege
Assume breach mentality
Separation of duties
Regular testing
Continuous improvement

Security Controls

Security across every layer.

ONTRACE.AI applies security controls at the infrastructure, data, access, and operational layers — the same defence-in-depth approach we help customers implement for their own ISMS.

Infrastructure Security

The ONTRACE.AI platform is deployed on enterprise-grade cloud infrastructure with security hardening applied at every layer.

Production infrastructure deployed in isolated, hardened environments
Network segmentation with least-privilege access between components
Infrastructure-as-code with mandatory review processes for all changes
Automated vulnerability scanning of infrastructure components
Immutable infrastructure with regular rotation of compute instances
Load balancing, DDoS protection, and availability zones for resilience

Data Handling & Storage

Customer data is treated as the most sensitive asset in our environment, with controls designed to exceed the standards we help customers implement.

AES-256 encryption for all customer data at rest
TLS 1.3 for all data in transit — no legacy protocol support
Logical tenant isolation — customer data is never commingled
Database access restricted to application service accounts with minimal permissions
Backup encryption with separate key management
Data retention policies enforced automatically with verified deletion

Access Controls

Access to ONTRACE.AI production systems follows the principle of least privilege with multi-factor authentication required at every access point.

Zero standing access to production — all access requires just-in-time elevation
MFA enforced for all internal systems and cloud console access
Role-based access control with regular access reviews
Privileged access management with session recording
SSH key rotation and certificate-based authentication
Contractor and vendor access time-limited and audited

Monitoring & Detection

Continuous monitoring across the ONTRACE.AI environment provides real-time visibility into security events and anomalies.

Centralized log aggregation with tamper-evident storage
Automated alerting on security anomalies and access violations
Intrusion detection system monitoring all production network traffic
Runtime security monitoring for container workloads
Regular threat hunting exercises by the security team
Third-party penetration testing at minimum annually

Incident Response

Documented incident response procedures are tested regularly and include defined escalation paths, customer notification obligations, and post-incident review.

Documented incident response plan aligned to ISO 27035
Defined severity classification and escalation matrix
Customer notification procedures within contractually agreed timescales
Post-incident reviews with documented lessons learned
Tabletop exercises and incident simulation at minimum annually
Dedicated security incident response team with 24/7 escalation capability

Change Management

All changes to the ONTRACE.AI platform undergo a structured review process to prevent unauthorized or error-prone modifications.

All code changes require peer review before deployment
Automated testing gates prevent deployment of failing code
Staged deployments with rollback procedures
Change advisory process for production infrastructure modifications
Dependency vulnerability scanning in CI/CD pipeline
Signed container images and artifact integrity verification

Third-Party & Supply Chain

We manage our supply chain risk rigorously.

As an ISMS platform, we take our own third-party risk obligations seriously. All sub-processors and critical suppliers are assessed before onboarding and reviewed periodically.

Sub-processor security assessments before onboarding
Contractual security obligations in all supplier agreements
Data processing agreements with all data-handling sub-processors
Annual review of critical supplier security posture
Sub-processor list available to customers on request

Security Testing

We test our security — not just assert it.

Documented security controls are only as good as their last test. ONTRACE.AI maintains a regular testing programme to validate that controls work as designed.

Penetration Testing
Minimum annually

By independent external assessors

Vulnerability Scanning
Continuous

Automated scanning of all production components

Incident Response Exercises
Minimum annually

Tabletop and simulation exercises

Access Review
Quarterly

All production and administrative access reviewed

Responsible Disclosure

Found a vulnerability? We want to hear from you.

If you believe you've found a security vulnerability in ONTRACE.AI, please report it responsibly. We are committed to working with the security research community to protect our customers.

01

Report

Submit your finding to our security team via the contact form. Include as much detail as possible — steps to reproduce, impact assessment, and any supporting artefacts.

02

Acknowledge

We will acknowledge receipt of your report within 3 business days and assign it an internal tracking reference.

03

Triage

Our security team will triage the finding, assess severity and impact, and communicate a preliminary assessment to you within 10 business days.

04

Remediate

We will work to address confirmed vulnerabilities with timescales aligned to severity. Critical findings receive immediate attention.

05

Disclose

We coordinate disclosure timing with reporters. We are committed to responsible disclosure and will not pursue legal action against good-faith reporters.

Scope & Guidelines

In scope: ONTRACE.AI web application and API
In scope: Authentication and authorization flaws
In scope: Data exposure vulnerabilities
Out of scope: Social engineering attacks
Out of scope: Physical access attacks
No automated scanning without prior written permission

Security Assurance

What you can request from our security team.

Security Questionnaire

Comprehensive answers to standard security questionnaires (SIG, VSAQ, custom).

Data Processing Agreement

GDPR-aligned DPA with details on sub-processors and data handling obligations.

Penetration Test Summary

Executive summary of most recent third-party penetration test findings and remediation status.

Security Review Call

Live conversation with our security team for enterprise procurement and due diligence processes.

Security Contact

Questions about our security practices?

Enterprise security teams, procurement teams, and security researchers are welcome to contact us directly. We aim to respond to security enquiries within 3 business days.