99.9%
Targeted availability
AES-256
Encryption at rest
All tenants
Row Level Security
Enforced
AI tenant isolation
Trust badges
Frameworks our controls map to. Certification status is published in the Compliance Center.
UK GDPR
AlignedProcessor model, DPA, UK IDTA.
EU GDPR
AlignedProcessor model, DPA, SCCs 2021/914.
CCPA / CPRA
AlignedRights workflows, no sale of personal information.
ISO/IEC 27001:2022
Controls mappedISMS in operation. Certification roadmap.
ISO/IEC 42001 (AI)
Controls mappedAI management system aligned with ISO 42001.
SOC 2
Controls mappedSecurity, Availability, Confidentiality.
Cyber Essentials
AlignedFive core technical controls.
NIS2
AlignedIncident response & supply-chain controls.
EU AI Act
AlignedLimited-risk AI features with transparency.
DORA
On roadmapICT third-party controls for financial entities.
HIPAA
On roadmapBAA scope under evaluation.
FedRAMP
On roadmapUS-region deployment under evaluation.
Platform status
Live system status, incident history and scheduled maintenance windows are published at status.track-project.com. Workspace administrators can subscribe to incident updates by email or webhook.
Security practices
Defence-in-depth security covering authentication, encryption, Row Level Security, tenant isolation, audit logging, vulnerability management and continuous monitoring. See the Security Center for the full control set.
Privacy commitments
Customers own their data. We process it only to deliver the service, never sell it, never use it to train shared AI models, and provide self-service export and deletion.
AI commitments
Permission-aware, tenant-isolated, auditable and explainable AI. We do not train shared models on Customer data and we require human verification for material decisions. See Enterprise AI Governance for the full programme.
Compliance roadmap
TrackProject is built to map cleanly to leading frameworks. Current status, evidence and target dates are published in the Compliance Center.
Infrastructure overview
Multi-region cloud hosting in the UK and EU with global edge delivery, isolated production and staging environments, automated backups and disaster-recovery testing. See the System Architecture page for the data-flow diagram.
Availability
We target 99.9% monthly availability for the production service. Enterprise customers may execute a written SLA with service credits and tighter RPO/RTO targets.
Incident transparency
Post-mortems for material incidents are published on the status page with root-cause analysis and follow-up actions. Affected Customers are notified directly within 72 hours of confirmation.
Responsible disclosure
Security researchers are welcomed and protected under our Responsible Disclosure programme. Reports go to security@track-project.com.
Last security review
The most recent platform-wide security review concluded on 2026-05-12. Continuous controls run 24/7. Next scheduled review: 2026-09-25.