Every asset verified. Every dataset auditable.

Every dataset available through Your app is backed by a public audit trail recording contributor consent, policy acceptance, provenance signals, and compensation status. Verify any asset. Review any dataset. Audit the full chain of custody.

Verify dataset

We work with

What we hold, and when it was last verified.

Frameworks Your app operates under and the third-party audits that stand behind them.

Last verified

Targeted

Last verified

What we audit, openly.

Select the controls that apply to you, and unselect any that don't. Items tagged Computed by Trace are calculated automatically from your real receipts and are always included.

Data handling

How data is collected, what's retained, and how it can be removed.

In place
In place
In place
In place
In place

Contributor identity

Who's allowed to contribute, and how their identity is verified.

In place
In place
Computed by Trace
In place
In place

Consent & rights

What the contributor agreed to, and how that agreement is preserved.

Computed by Trace
Computed by Trace
Computed by Trace
In place
Computed by Trace

Audit & verification

How any party can verify the claims above, independently.

Computed by Trace
Computed by Trace
External
In place
Monitored

Regulatory frameworks

Compliance regimes you operate under, declared on every receipt.

In place
In place
In place
Computed by Trace
Computed by Trace

Download

For your compliance file.

The documents your team can download directly.

The agreement every contributor accepts before submitting data. Content-addressed, with all historical versions retained and verifiable.Send this file (PDF or URL) to Trace
How contributor data is collected, used, retained, and protected. IPFS-pinned and cryptographically verifiable against the Trace ledger.Send this file (PDF or URL) to Trace
The full list of third-party vendors with access to operational data, updated quarterly with 30-day advance notice of any change.Send this file (PDF or URL) to Trace
Our declared obligations as a provider under Article 53 of the EU AI Act.Send this file (PDF or URL) to Trace

F.A.Q.

The questions your customers ask most. The “Contact us” button emails:

Are you GDPR-compliant?
Yes. We operate GDPR-compliant flows for all contributors with EU regional metadata, and expose the operative TOS / privacy policy version on every receipt. EU contributors retain the right to revoke consent, visible on the lifecycle of the affected receipt.
How can a contributor revoke consent?
Through their account at any time. Revocation produces a new lifecycle event on each affected receipt and removes the asset from active datasets. The receipt itself remains visible on Trace as a permanent audit record.
What sub-processors do you use?
Identity verification: Persona. Payments: USDC · Stripe Connect. Cloud infrastructure: AWS (eu-west-1, us-east-1). Public audit layer: Trace / The Data Foundation. A live sub-processor list is maintained in the disclosure above.
Why is the audit trail on a separate, public layer?
Building an audit surface in-house creates a permanent target for accusations of bias. Trace is the impartial alternative: a public, onchain ledger that customers, regulators, and contributors all check on the same terms. We contribute receipts to it; we don't control its visibility.
How are sensitive metadata values handled?
Sensitive signals like EXIF, GPS, IP addresses, and device fingerprints stay in our own systems. Trace stores existence flags (present or absent), never the values. This preserves the integrity signal labs need without making the audit layer a deanonymization tool.
Where can I see the underlying data?
We don't expose the underlying assets through this portal, receipts and consent posture only. Labs evaluating a dataset for licensing are given access through our commercial channels.