Security
Built so your change board can say yes.
An AI that touches production ERP has to be more careful than the people it helps. These are the commitments Trace is built on, and the ones we put in writing.
Audit trail · INC0048213
9f2c…e41a ← links to the previous entry
Four principles. The commitments Trace is built on, written into every agreement.
Your data stays in your environment
By default a Replay runs on a machine you control. If you’d rather we run it, the data is processed in a region you choose and deleted at the end. Customer tickets are never sent to free or shared AI endpoints, and nothing is used to train models.
Every production change goes through your change board
Trace works inside your change process, not around it. Approval steps are recorded with the approver's name.
Least privilege
Trace acts through a dedicated SAP user with only the transactions its earned ticket types need. Nothing is installed on the SAP system.
Reversible by default
Only fixes that can be undone may ever run without a person. Anything touching money or authorizations always waits for approval.
How Trace connects to SAP
This is the design we are building with design partners. Today a Replay needs no connection at all: it reads a CSV export of closed tickets.
We share the exact SAP roles and authorizations, line by line, before any pilot starts.
A small connector inside your network
It runs in your own environment and only makes outbound connections to Trace. Nothing is installed on the SAP system.
A read-only user for evidence
Trace reads IDoc statuses, job logs, short dumps, locks, authorization checks, change documents and transports. Reading cannot change anything.
A separate user for each kind of fix
Fixes run through a dedicated technical user per task, with only the transactions that task needs. They are tried in your quality system first.
Your ticket tool and your change process
Trace reads and updates tickets in ServiceNow, Jira or Solution Manager, and raises a change request for your board before any production change.
If something goes wrong
Every safeguard below is part of how Trace decides, not a promise added afterwards.
It checks its own work
After every fix, Trace reads SAP again to confirm the result, for example that an IDoc reached status 53. If the check fails, the ticket goes to a person with everything attached.
It loses autonomy on any slip
An incident, a rollback or a missed SLA moves that task back to approval-only automatically. It has to earn its way back on new evidence.
One switch stops it
You can return every task to approval-only in one click. Reversible fixes carry their undo steps, recorded in the audit trail.
A tamper-evident audit trail
Every action Trace takes, from reading a ticket to verifying a fix, is written to an append-only log. Each entry carries a hash of the one before it, so a deleted or edited entry breaks the chain and shows up immediately.
Who, what, when, why
Every entry names the actor (Trace or a person), the action, the evidence and the outcome.
Exportable for auditors
Hand the full chain to internal audit or your SOX reviewers as one file.
Kept for as long as you need
Retention follows your policy, not ours.
Where we are on compliance
Assay is a new company, and we would rather be precise than impressive.
Today
Written security commitments in every design-partner agreement, masking of personal data before Replay, and a named security contact.
Planned
SOC 2 Type I before the first Operate contract, then Type II. A penetration test and cyber and professional liability insurance before the first paid pilot. ISO 27001 alignment for customers who need it.
Your review
We complete your security questionnaire and join your architecture review before any pilot starts.
Found a vulnerability? Email security@assayams.com. We reply within two working days.
Start with a read-only Replay.
Replay never touches production: it reads closed tickets only. It's the safest way to see what Trace would do.