Trust

Working in the product today, or written into the Terms or Data Processing Agreement.

Documented and reviewed by Trace. Nobody outside Trace has checked it.

Reviewed by an outside party against a named standard, with a report a school can read.

Not done. Listed so a reviewer does not have to ask.

A student's name, email, and other direct identifiers are removed before any content is sent to a model.

Every model request carries a zero-retention instruction to the provider, on every path: chat, agent runs, speech, and safety review.

Only models on a fixed allowlist can be reached. Students never hold an account with a model provider.

Trace does not use student data to train models and does not sell it.

The privacy policy, Data Processing Agreement, and subprocessor list are public. Schools can request a signed copy.

Anyone signed in can export their account data and delete their account. School export and deletion requests are handled within 30 days.

Independent confirmation that each serving provider honors the zero-retention instruction. Trace sets it on every request but does not yet record which provider served a request.

Automatic retention limits for most data classes. Audit metadata expires after 365 days. Other records stay until a school or person asks for deletion.

Full erasure on account deletion. Deletion removes identifying information and keeps de-identified records. Complete erasure is done by hand on request.

Each student message and each model reply is screened before it is stored or shown. Blocked content is withheld and the teacher sees a flag, not the text.

Teachers can read the AI conversations in their class and see any flags.

Agents can call only the tools Trace ships. There are no open web requests.

Every run has token, step, and cost limits, and each class has a monthly credit balance that students draw from.

A public AI system card, a red-team report, and a repeatable test suite for safety failures.

All traffic is encrypted in transit. Roles decide who can open what, and nothing is public by default.

Administrative actions are recorded as audit events.

Production refuses to start with development defaults such as mock sign-in, a development secret key, or a fake email adapter.

A coordinated vulnerability disclosure policy and a security.txt file. Reports are acknowledged within two business days.

A written information security policy, incident response plan, risk register, and control matrix, reviewed quarterly. Available to school reviewers on request.

An independent penetration test.

A clean automated dependency scan. Scans are configured to run weekly and on every change, and the current runs are failing.

Centralized logging with alerts, and a secret manager. Secrets are held as environment variables on the production host.

SOC 2 or ISO 27001. Trace will start this once the controls above have operated for a period and school demand justifies it.

An internal assessment in August 2026 used automated tools and source review. Result: not yet conformant. Four root defects and sixteen criteria still need a manual pass.

An independent audit, testing with screen readers and keyboard only, and a completed Accessibility Conformance Report (VPAT).

The database is backed up automatically every day.

Restore drill on September 22, 2026: the previous day's backup was restored into a fresh database in under a minute. Every table and the schema revision matched production.

Backup copies off the production host. The backup job supports an encrypted off-host copy. The destination is being selected.

Managed hosting. Trace runs on a server it operates itself. A hosting provider with a published SOC 2 or ISO 27001 report is being selected and will be added to the subprocessor list.

A public status page, incident history, and uptime monitoring with alerts.

A transactional email provider under a data-protection agreement.

Trace Education LLC is built and run by one person, David Wu. That is stated on the About page rather than hidden.

If Trace shuts down, schools get notice and a way to retrieve their data first (Terms, section 12). On termination, student data is deleted or returned within 60 days and confirmed in writing (Data Processing Agreement, section 7).

A second trained operator, credential escrow, and a named emergency contact outside Trace.

Public pricing: $50 per teacher per month with a three-teacher minimum, or a district agreement. One bill per school, by card or by purchase order and invoice.

A signed Data Processing Agreement and a pilot agreement, on request.

A certificate of insurance and state-specific data privacy addenda.

Named school customers, references, or case studies. Trace is looking for design-partner schools to run a free six-week pilot.

Any third-party certification, seal, or audit report. None exists for Trace yet. This page will change when one does.