Your organization's data stays yours
Every assessment, answer, document, audit record and setting belongs to one organization. Every query is scoped to it, and automated tests check that one organization can never read another's data.
Security & trust
Built for the people who answer security questionnaires
You trust Tradecraft with your security posture. Here is how we protect it.
Mandatory multi-factor authentication
Every Tradecraft password login requires an authenticator app (TOTP) with one-time recovery codes. Repeated failed attempts lock the account temporarily.
Single sign-on and provisioning
Use your identity provider over OIDC (Microsoft Entra ID, Google, Okta) or SAML 2.0, and provision or deactivate people automatically with SCIM 2.0 or Google directory sync.
Secrets encrypted, never shown
Integration credentials and identity-provider secrets are encrypted with AES-256-GCM before they are stored. Screens only ever show “Configured”. Access tokens are stored as hashes.
Role-based access and human approval
Users, reviewers, approvers and admins each see only what their role allows. AI drafts never become approved answers without a reviewer and an approver; AI tools can only propose.
Audit log
Changes to assessments, knowledge, members, roles, sign-in and configuration are written to your organization's audit log, without secrets or answer text in the details.
Read-only connections
Connected sources such as Confluence, Microsoft SharePoint, Microsoft OneDrive and Google Drive™ are read with read-only access. Tradecraft never writes back to them.
Accounted AI usage
Models run on Microsoft Azure AI Foundry. Every AI call is recorded with its real token usage and counted against your organization's monthly AI budget.
Hosting
Tradecraft runs on Microsoft Azure. Data is encrypted in transit with TLS and at rest by the Azure database and storage services. Platform secrets are held in Azure Key Vault.
Coming soon Not available yet
- A tamper-evident audit ledger for every document and approval.
- Signed receipts so you can verify a downloaded questionnaire offline.
Need a completed security questionnaire about Tradecraft itself, or want to report a vulnerability? Contact us.