TRACE Nexus, Internal Governance

Governance documents

The Incident Response Plan, Access Control Policy, and Vendor Risk Management Policy behind TRACE Nexus, written to be true right now rather than aspirational.

Not a certification claim. These are the prerequisite groundwork a SOC 2 Type II or ISO 27001 audit would require before that process can even begin, not the audit itself. Owner: Himaja Prabhala. Version 1.0, effective 2026-08.

Incident Response Plan

v1.0 · 3 pages

How a security or availability incident is identified, contained, and reviewed, including a real access-control incident from this system's own development, used as a worked example rather than a hypothetical.

Severity classification, detection sources, five-step response, review cadenceView PDF

Access Control Policy

v1.0 · 2 pages

The three enforcement layers in front of case data, and why row-level security, not application logic, is the actual boundary.

Layer model, RLS, roles, provisioning, credential handlingView PDF

Vendor Risk Management Policy

v1.0 · 2 pages

Every third party that touches case data, what each one is independently certified to, and the standard any future vendor has to meet first.

Vendor inventory, certifications, onboarding standard, monitoringView PDF

What these are not: proof of certification, evidence of a security team, or a claim about production client data. TRACE Nexus is currently a single-maintainer system running on synthetic case data. These documents are the honest starting point, not the finish line.