How Tracemark protects itself.
Signed updates, device identity, roles and an audit trail you can export.
A security product has to be hard to turn against you.
Tracemark has an agent with high privileges on every device. These are the controls that keep that power with the right people.
Signed agent updates
Every agent build is signed in our build pipeline with a key that never sits on a customer server. Agents check the signature and the hash before they run a new version, and refuse anything unsigned.
Device identity in hardware
Each agent proves who it is with a client certificate. Where the device has a TPM, the private key is created inside it and cannot be copied off the machine.
Cloned identities are flagged
When one device identity shows up from different networks in quick succession, the console raises an alert.
Approval for new devices
Optionally hold new enrolments, or only those that are not known domain computers, until an administrator approves them.
Privileged work stays in the service
Installs, encryption and service control are done by the agent's own system service from instructions it fetches itself. Requests from other programs on the device are not trusted.
Roles that hide what they cannot use
Permissions are fine-grained, and a role sees only the pages and actions it is allowed. Signing everyone out at once revokes every session immediately.
Everything is audited
Every administrative action is recorded with who, what and when, and the log can be exported with a signature that shows it was not altered.
Secrets encrypted at rest
Stored credentials, such as the domain push account, are encrypted with AES-256-GCM and are never sent back to a browser.
Your data stays with you.
- Self-hosted. The console, the database and all evidence run on your own servers.
- Detection on the device. Content is inspected by the agent; only decisions and the evidence you keep are sent to your server.
- Works offline. Agents keep enforcing the last policy they received and queue events until your server is reachable.
- Backups you control. A backup and restore runbook for the database is part of the installation.
Want a walkthrough?
We set it up with you on a test group of your own machines.