Access Model
Read-only permissions
We only request the minimum OAuth scopes needed to read events from your systems. We never request write, update, delete, or admin permissions.
Least privilege principle
Our integration tokens are scoped to specific data types (events, tickets, orders) and cannot access broader system configurations, user management, or sensitive settings.
No workflow changes
Our system observes and reconstructs traces from existing events. We do not create, modify, or delete any records in your operational systems.
Data Storage
Infrastructure
Event data is stored in encrypted cloud infrastructure (AWS/GCP) with:
- Encryption at rest (AES-256)
- Encryption in transit (TLS 1.3)
- Per-customer data isolation
- No cross-tenant data access
Data residency
Data is stored in US-based data centers by default. Regional data residency options are available for enterprise customers with specific compliance requirements.
Data Retention
Configurable retention periods
Default retention is 90 days of trace data. You can configure shorter retention periods if required by your policies.
Data deletion
Upon account termination or request, all customer data is permanently deleted within 30 days. We can provide deletion confirmation upon request.
PII handling
Sensitive fields can be masked or excluded from ingestion based on your configuration. We work with you to define what data is necessary for trace reconstruction.
Access Logging & Auditability
Comprehensive logging
All data access is logged with timestamps, user identifiers, and action types. Logs are retained for 12 months.
Audit reports
Audit logs are available upon request for compliance reviews. We can provide access logs in standard formats for your security team.
Authentication & Access Control
SSO support
Enterprise customers can integrate with their existing identity provider (SAML 2.0, OIDC) for single sign-on.
Role-based access
Access to trace data can be scoped by team, vertical, or system based on your organizational structure.
Contact
Security questions?
We're happy to discuss our security practices, complete security questionnaires, or schedule a call with our security team.
Email: shreyasb@trykantora.com