This article collects the security facts that admins and procurement reviewers ask about most often. It describes the product as shipped; your own deployment may switch some options off.
Signing in
The sign-in page offers these methods. Your deployment decides which ones appear.
Google, Microsoft and GitHub - click Continue with Google, Continue with Microsoft or Continue with Github to sign in with an existing account. No setup is needed.
Magic link - enter your address and click Continue with email. The link that arrives is valid for 30 minutes and must be opened in the same browser that requested it. See Email authentication using Magic Link.
Log in with SSO - organizations that have configured an OpenID Connect provider (Okta, Entra ID, Auth0 or a custom provider) sign their members in through it. Trace.Space finds the right organization from the email domain you enter. See Single Sign-On (SSO).
A username and password form exists only for development, trial and pilot deployments where an operator has explicitly enabled it. It is not available on the hosted service.
Sessions and signing out
Policy | Value |
Signed-in session (refresh token) | 30 days |
Concurrent sessions per user | 5. Signing in on a sixth device signs out the oldest session. |
Magic link validity | 30 minutes, single use |
Refresh tokens are stored as hashes, never in plain text, in a cookie that only the sign-in service can read. To end your session, open the settings menu at the top of the left sidebar and click Sign out. This clears the session cookies in that browser.
Tokens for the API and connected tools
API client tokens (OAuth 2.0 client credentials) last 15 minutes. Client secrets are stored hashed and are shown once, at creation. See API clients.
Connected AI assistants (MCP) sign in with a standard OAuth authorization code flow with PKCE. Access tokens last 1 hour; refresh tokens last 30 days and are rotated on every use. See MCP server setup.
How secrets are stored
Every secret an organization enters is encrypted at rest in a per-organization secrets store and is never displayed again after you save it:
the Client secret on the SSO page,
the API Key of each AI provider you add on the AI Providers page (bring your own key),
the SMTP password on a self-hosted deployment.
When you edit one of these settings later, leave the secret field blank to keep the existing value.
Your data
Each organization has its own database. Data from one organization is never mixed with another's.
Every change is kept. Items are event-sourced, so every version of every item is retained and can be viewed or reverted. See Item history and versions.
People are suspended, not deleted. When someone leaves, an org admin suspends the account. Everything they created stays in place with their name on it. See Managing users.
Deleted items can be restored from the tree, the document view or the single item view.
AI features
AI features send content to the AI provider your organization has chosen, and only when you use them. Prompt and response text is stripped from usage telemetry. See How AI features handle your data.
Optional third-party services
The web app can load a small number of third-party scripts. Each is a deployment option that an operator switches on by configuration, and none of them is loaded when the option is absent:
PostHog - product analytics.
Google Analytics - web analytics.
Intercom - the in-app Help & feedback messenger. When Intercom is not configured the menu entry is hidden.
Sentry - error reporting.
Self-hosted deployments typically run with all four switched off.
Hosting regions
The hosted service runs in two regions. Your organization lives in one of them and its data stays there.
Region | App | API |
Europe |
|
|
North America |
|
|
Trace.Space can also be installed on your own infrastructure. For the administration area that comes with a self-hosted installation, see System administration (self-hosted).