A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →Version 1.3 · effective October 19, 2026
The short version. These are the processor terms for traztech Workspace. You are the controller of what you put in it. We process it to prepare and evidence your audit, on your instructions, and for nothing else.
You do not need to send us a data processing agreement to sign. This schedule is incorporated into the engagement, and a copy of it is filed against our record in your own supplier register the day your workspace is created, so that row arrives complete.
It is versioned. When these terms change the version changes, the previous document stays on your file, and every workspace is re-issued rather than the text quietly moving underneath you.
TrazTech Inc. and the Customer
Version 1.3 · effective 19 October 2026
This schedule forms part of the engagement between the parties and governs personal data processed by TrazTech while providing audit preparation services. It is a standing term: it is published at https://traztech.ca/dpa and incorporated rather than negotiated per engagement, and it is versioned so a change is visible rather than silent. The published copy and this one are rendered from the same source, so they cannot disagree.
the Customer is the controller. TrazTech is a processor acting on documented instructions, which are the engagement scope and anything given in writing during delivery. TrazTech does not determine the purposes of the processing and does not process the data for its own purposes.
TrazTech does not receive your production data, your customers' data, or special categories of personal data. Screening is recorded as a completion date and method; the underlying report stays with you.
Connected systems are read only for the fields a check needs. From identity, HR and code hosting tools that is names, work email, role, department, employment and account status, MFA state, last sign-in and group membership, kept by design because access reviews and rosters are built from them. Other personal data that arrives by accident is removed before it is stored: pattern-based detection replaces government ID numbers (SIN, SSN, passport, driver's licence), health card and medical record numbers, payment card and bank numbers, dates of birth, home addresses, personal phone numbers and email, salary and special-category fields with a marker, and only the type and count are recorded. The same identifiers are removed from text before anything is sent to the AI model. Detection works on recognisable formats and labels, so an identifier with neither can be missed.
Processing is limited to preparing, evidencing and supporting your audit, and lasts for the engagement plus the retention period below.
The workspace is hosted in Canada, on Akamai Connected Cloud in Toronto, with Cloudflare in front; the origin accepts traffic only from Cloudflare. Not all of our sub-processors are in Canada, and some process data elsewhere, including in the United States: edge protection, email delivery, and, where the workspace permits AI processing, the AI model provider. Each is bound by appropriate confidentiality and security terms, and they are listed at traztech.ca/subprocessors.
Akamai Connected Cloud (hosting, Canada), Cloudflare (edge protection and DNS), SendGrid (transactional email), and Anthropic (AI model provider for the staff-side workspace assistant, United States). TrazTech remains responsible for their acts and omissions. You will be told before a new sub-processor handling your personal data is added, and may object.
The AI model provider, Anthropic, is used for the assistant TrazTech staff use in the workspace, unless your agreement with TrazTech restricts AI, in which case nothing from the workspace is sent to it. It does not train its models on this data, and everything the assistant drafts is reviewed by a TrazTech person before it is used.
Everyone at TrazTech with access is bound by written confidentiality obligations that survive the end of their engagement.
TrazTech will assist with data subject requests, impact assessments and regulator enquiries so far as the data it holds allows, and will notify you without undue delay, and in any case within 72 hours, on becoming aware of a personal data breach affecting your data.
You can export every register and download every uploaded file at any time, without a request or a waiting period. On written request, or within 90 days of the engagement ending, the workspace and its contents are deleted, save where retention is required by law.
TrazTech will make available the information reasonably necessary to demonstrate compliance with this schedule, and will accept a documented security questionnaire once per year. TrazTech does not currently hold its own SOC 2 or ISO 27001 report, and says so plainly rather than implying otherwise.
TrazTech sits outside the Customer's system boundary: it operates no control that the Customer's service commitments depend on, and is therefore neither carved out of nor included in the system description. It is listed on the supplier register because supplier management (ISO 27001 A.5.19, A.5.20 and A.5.22; SOC 2 CC9.2) covers third parties with access to information. ISO 27001 A.5.21 does not apply: this is a professional service, not an ICT supply chain product.
Anything about this schedule, a data subject request, or a security question before you put data in the platform: [email protected]. Suspected vulnerabilities go to [email protected], and we will not threaten anyone who reports one in good faith.
Related: privacy policy, how the platform handles your data, terms of service.