You will run a third-party review on us. Here is everything it asks for.

Postgres row-level security, enforced under an application role that cannot bypass it. A missing filter in a query fails closed rather than returning another tenant's rows. Isolation is tested under a non-bypassing role; the suite skips rather than passes when that role is absent, because an isolation test run as the database owner passes while observing nothing.

Server actions are addressable over HTTP; being defined inside a component restricts nothing. Each one re-establishes the actor and their organisation rather than trusting that it was called from its own form.

The verification-token table has row-level security enabled with no policy at all, so the tenant-scoped role can neither read a live magic link nor mint one for an address of its choosing. Only the pre-authentication path touches it, and the arrangement is asserted by a test rather than assumed.

Sign-in is a single-use magic link with TOTP two-factor authentication. There is no password to lose or reuse. Platform administration is limited to a named allowlist and requires two-factor authentication.

The database is in the European Union (Frankfurt). Application functions and evidence storage are pinned to the same region. The content delivery network is global and carries no register content.

Request bodies, cookies, authorisation headers and query strings are stripped before an event is sent, and record identifiers in the path are replaced with a placeholder. A report says which screen failed, never whose record it was.

Served through time-limited, non-guessable links rather than from a predictable path.

None is currently designated. Sodasoft LLC is established outside the Union, which means Article 27 requires one in writing, and an EU sub-processor does not satisfy that. A company inside the European Union is being established to contract with customers directly; when it takes over the agreements the obligation falls away. Stated here rather than left to be discovered, because it takes a reviewer about a minute to find out where the operating company is registered.

A DPA is published rather than negotiated from scratch per deal, with the processing description, the sub-processor list, the security measures and the assistance obligations in it.

Every document is hashed on upload and the hash is recomputed from the stored file on a weekly sweep and on demand. A check reports one of three things and never two: verified, altered, or unreadable. A storage outage is not tampering and is never reported as a pass either. File identity, uploader and timestamp cannot be edited after upload.

Every create, update, delete, privileged action and record view, with the fields that changed and the state before and after. Filterable by entity, action, person and period, and exportable as a CSV that states whether it was truncated.

Audit records are kept for 5 years after the agreement ends - long enough to answer a supervisory question about a filing made during the relationship, and bounded, which is what a lawful retention period has to be.

On termination or an erasure request the workspace goes read-only immediately so an export is still possible, and the data is irreversibly deleted at the end of a 30-day grace period. A scheduled job carries that out; it is not a manual promise.

Each submitted package is kept with its hash, taxonomy version and the validation run behind it. Later changes to the register never alter what was filed, so what the authority received can always be reproduced.

Public API 120 requests per minute per key, returning 429 with a Retry-After header. Sign-in links 5 per 15 minutes per address. Bulk import up to 6 MB. AI actions are capped with a hard stop rather than automatic overage billing, and nothing on the compliance path uses AI, so reaching a limit never blocks filing work.

It requires an owner to switch it on, only ever suggests, and never writes to the register. Regulatory validation and submission generation are deterministic and stay that way.

Every dependency we add becomes an entry in a customer's own register, so the external surface is kept small deliberately. Advisories are tracked, and one that is left open is listed with the reason rather than left unmentioned.

None has been commissioned. When one is, the report summary and the remediation status will be published here rather than described.

Neither is held, and neither is claimed anywhere in our material. If a certification is a hard requirement for your procurement process, that is a reason not to buy yet, and we would rather you knew now.

The architecture is a managed EU Postgres with point-in-time recovery and a stateless application tier, but no tested BCP/DR plan has been written down and no platform RTO or RPO has been committed to. Publishing a number we have not tested against would be worse than publishing nothing.

The architecture, the trust boundaries and the data flow can be walked through with your security reviewer. The written version is being assembled from what is on this page.

Report a suspected vulnerability to security@treica.com rather than opening it publicly. Please do not access any customer's data while investigating and do not run automated scanning against production. We acknowledge and give a first assessment within ten business days - a longer window than a large vendor publishes, and one a small team will actually meet.

Most standard questionnaires can be answered from this page and the linked documents. Send yours and we will complete it against the same facts rather than a different set.