Posture
Security, and the limits of what this tool does
TraceLens handles some of the most sensitive data a state holds. The design assumes that, and so does this page.
Lawful use
TraceLens analyses call-detail, internet-protocol-detail and tower-dump records lawfully obtained from operators. It has no interception, wiretap or live-capture capability, and none is planned: interception happens inside carrier lawful-interception infrastructure under a warrant, and no analysis application substitutes for that.
The feed endpoint ingests records that an authorised upstream system sends to it. Watch rules alert on those arriving records. That is the whole of what “live” means here, and the API states it in its own responses so the distinction survives into anything built on top.
Isolation
- Schema-per-tenant: each unit's records live in their own PostgreSQL schema, not behind a WHERE clause.
- The on-premise build is the same stack with a single tenant, licensed offline.
- A tenant-configurable IP allowlist restricts where the workspace answers from at all.
Evidence integrity
- SHA-256 and MD5 computed on upload; originals stored immutably. ZIP members are hashed individually.
- Re-parsing replaces derived rows atomically and never touches the original.
- QC reconciliation per file: rows scanned = structural + loaded + rejected, with reasons.
- Every export carries a Section 63(4) certificate and a result hash computed over the rows — reproducible from the same inputs, identical across all six formats.
Access
- Roles (admin / investigator / analyst / viewer); viewers are read-only everywhere.
- Object-level case permissions on every endpoint: a case you cannot see answers 404, so its existence is not disclosed.
- TOTP two-factor with per-tenant enforcement — an unenrolled user in an MFA-required workspace gets an enrolment-only token and nothing else.
- JWT with a 30-minute access token and rotating, blacklist-on-rotation refresh tokens; auth endpoints rate-limited against brute force.
Audit & approval
- Append-only audit log of every authenticated interaction — view, upload, export.
- Optional export approval: a non-admin's export is held until a workspace admin approves it.
- Optional export watermarking, stamped by workspace policy.
- Platform-level actions (tenant lifecycle, impersonation) land in their own append-only platform audit log.
Retention & destruction
- A workspace retention window, enforced by a nightly sweep over closed cases.
- The destruction record is written first, in the same transaction that purges — tamper-evident by construction.
- Deleting a whole workspace issues a hash-stamped destruction certificate that survives the tenant it certifies (DPDP posture).
Data residency
- On-premise and air-gapped installation with an offline, signed licence key. No phone-home, no telemetry.
- The default geo map requests no basemap tiles, so case geography never reaches a third party.
- Case briefs run against a local model or a deterministic template — no case data leaves the deployment.
- Enrichment reference data (device TAC, operator LRN, anonymiser feeds) loads from files on disk.