TraceSpec Data Protection & Processing Page
Effective date: 29 August 2026 Last updated: 31 August 2026
This page summarises TraceSpec’s current data-protection, hosting and subprocessor posture. It supports the Privacy Policy, Cookie Policy, Terms of Business, Data Processing Addendum and Security Statement.
TraceSpec is operated by Elyven Ltd, a company registered in England and Wales under company number 17328579, trading as TraceSpec.
This page may be published publicly or made available on request. It is intended as a practical transparency page; the legally binding terms are the Terms of Business, Data Processing Addendum and any signed order form or enterprise agreement.
1. Current hosting and processing posture
- Core database/backend: Supabase Pro, currently in AWS
eu-central-1/ Frankfurt. - Website/application hosting: Vercel Pro. Production functions are stated as pinned to Frankfurt (
fra1), aligned with the Supabaseeu-central-1project region. - Payments/subscriptions: Stripe.
- Service/support email: UK2.net / UK-2 Limited, operating under The Hut Group (THG), with primary email hosting indicated as London, UK.
- Analytics/tracking launch position: TraceSpec does not use Google Analytics, Vercel Web Analytics, advertising pixels, remarketing tags, Hotjar, session recording or heatmaps at launch.
- Source control/development workflow: GitHub.
TraceSpec aims to keep core application and database data in the UK and/or EEA where reasonably practicable, while recognising that some providers may process, access or transfer personal data internationally where necessary to provide their services.
2. Subprocessor and supplier matrix
The following matrix reflects TraceSpec’s current launch suppliers. Some providers are subprocessors for customer personal data; others are suppliers or independent controllers for parts of their service. The exact role may depend on the data and context.
| Provider | Purpose | Data categories | Indicative hosting / processing location | Transfer / legal mechanism | Launch status / notes |
|---|---|---|---|---|---|
| Supabase | Database, backend services, and potentially storage | Account/user data, workspace data, project data, activity logs, database backups | Primary project region: AWS eu-central-1 / Frankfurt | Supplier DPA / contractual safeguards; restricted transfers handled through provider terms where applicable | Supabase Pro. Daily database backups currently accessible for 7 days unless PITR or another backup configuration is adopted. |
| Clerk | Sign-up, sign-in, authentication and session management | User account identifiers, email address, authentication/session data, device/security metadata, organisation/workspace association metadata depending on configuration | Clerk states its data is hosted on US infrastructure, with EU/UK/Swiss personal data transferred to the US under the Data Privacy Framework. | Clerk DPA and transfer mechanism / DPF as applicable | Launch authentication provider. Current observed cookie and browser-storage technologies are described in the Cookie Policy. |
| Vercel | Website/application hosting, deployment infrastructure and serverless/functions | Website/app requests, IP addresses, logs, usage/performance data, application data processed by functions | Vercel global edge/CDN. Production functions stated as pinned to Frankfurt (fra1) for proximity to Supabase eu-central-1. | Supplier DPA applies on Pro/Enterprise plans; restricted transfers handled through provider terms where applicable | Vercel Pro confirmed. |
| Stripe | Payment processing, billing, subscription management, tax IDs and invoice metadata | Billing name, organisation, billing address, tax/VAT IDs, subscription/payment metadata, Stripe customer/subscription IDs | Global, including EEA/US processing where necessary for payment services | Stripe DPA, Stripe transfer mechanisms, Data Privacy Framework and/or SCC/UK Addendum where applicable | Used for hosted Checkout, payment processing, billing, subscription management, tax IDs and invoice metadata. |
| UK2.net / UK-2 Limited / THG | Service/support email and domain/email services | Email addresses, support correspondence, service emails, contact metadata | Primary email accounts/databases indicated as hosted in UK-based data centres in London. UK2 operates under The Hut Group (THG); group-level processing standards and subprocessors may apply. | UK2/THG service terms / data-processing terms; restricted transfers handled through provider terms where applicable | Location details based on account/provider information. |
| GitHub | Source-code hosting, issue/PR/development workflow | Developer account data, repository metadata, code/configuration; not intended to receive customer project content | GitHub/Microsoft infrastructure/global processing | GitHub terms/DPA as applicable | Do not put production secrets, customer project data or personal data into public repos/issues. |
| Professional advisers | Legal, accounting, tax, insurance and compliance advice | Limited account, contract, billing, risk, incident or compliance data as needed | Depends on adviser | Professional confidentiality and engagement terms | Usually independent controllers, not routine platform subprocessors. Use only as necessary. |
3. Data location notes
Data location is not the same as legal compliance. Even where core database data is hosted in the EEA, providers may still process support, billing, diagnostic, security or account data in other countries.
Where restricted transfers occur and safeguards are required, TraceSpec relies on appropriate legal mechanisms such as adequacy regulations/decisions, UK IDTA, UK Addendum, EU Standard Contractual Clauses, Data Privacy Framework certification where applicable, or equivalent lawful mechanisms under applicable data protection law.
4. Backup and retention notes
Supabase Pro daily database backups are currently accessible for the last 7 days unless point-in-time recovery, a higher plan or another backup configuration is adopted.
Backups are maintained for operational resilience and disaster recovery. They are not a customer archive service and are not a substitute for customers exporting or retaining their own reports and project records.
Deleted data may remain in backups until the relevant backup cycle expires, subject to technical and legal constraints.
5. Subprocessor change notice
TraceSpec may add, remove or replace subprocessors over time. Where required by applicable data protection law or the Data Processing Addendum, TraceSpec will provide notice of material subprocessor changes by updating this page, notifying account administrators, or using another reasonable method.
Customers may object to a new subprocessor on reasonable data-protection grounds in accordance with the Data Processing Addendum.
6. Contact
Data protection questions: privacy@trace-spec.com Support questions: support@trace-spec.com