Your infrastructure.
Your keys. Your data.
Trace Vantage is deployed inside the force environment. Operational records, evidence, communications and audit data remain within force-controlled infrastructure. Trace Intel does not require access to case data to operate, support or improve the platform.
Three ways to host it. One control principle.
Whichever model a force chooses, the platform runs inside infrastructure the force controls, not a Trace Intel-operated cloud.
On-premises
Installed on force-owned hardware inside a force data centre. Storage, network and physical security are entirely force-controlled.
Private force cloud
Deployed into a private cloud tenancy the force controls (including sovereign or government cloud regions), never a Trace Intel-operated or multi-tenant environment.
Disconnected / air-gapped
Deployed with no routine external network path, for environments where connectivity to any outside network is restricted by policy. Updates are delivered through the force's controlled import process.
How it sits inside your environment.
Core case, evidence and governance functions run without dependency on external cloud services. Optional intelligence sources and AI services are connected only under force authorisation.
What moves, and where it stays.
Six categories of data flow through the platform. Each has a defined default location and a defined boundary condition.
Case & entity data
Created and stored inside the force environment. Never replicated to a Trace Intel-operated system.
Evidence & exhibits
Stored in the local evidence vault with hashing and provenance; retention and disposal follow force policy.
Communications
Secure case-room and messaging content is stored within the force environment and subject to the same retention controls as other case material.
Audit & logs
Written to the local hash-chained audit trail; operational logs apply field-level redaction and stay within the boundary.
External intelligence
Only enters the platform through an approved connector, subject to the force's lawful basis and jurisdiction.
AI requests
Processed locally by default. A request only reaches an approved cloud model through the human-gated route, with the request and response logged.
How support, diagnostics and updates work without routine data access.
Trace Intel supports the deployed platform without needing to see the case data it holds. Support, diagnostics and updates are designed around that constraint, not around an assumption of access.
Updates
Delivered as versioned packages the force applies to its own environment; air-gapped deployments import updates through the force's controlled process.
Diagnostics
Health and performance telemetry is structural (service status, error codes, resource use), not case content, and is reviewable by the force before anything leaves the boundary.
Support access
Any session-based support access to force infrastructure is initiated and supervised by the force, time-limited, and logged in the audit trail.
No standing access
Trace Intel holds no standing credential into a force's production environment or data stores.
The controls that stay under your identity.
Identity
Authentication integrates with the force's own identity provider; account lifecycle follows force joiner/mover/leaver process.
Encryption keys
Keys for data at rest are held under force control. Trace Intel does not hold force keys.
Network
Deployed behind force network segmentation, firewalls and egress control, on-premises, private cloud or air-gapped.
Storage
Data resides on force-controlled storage, physically and logically within infrastructure the force operates.
Backup
Scheduled backups with force-defined retention, held within force-controlled infrastructure.
Logs
Access, evidential-action and AI-use logs are retained under force policy and available for the force's own review and disclosure processes.
Three modes, chosen by policy.
Local
Sensitive work processed entirely inside the force environment. Nothing leaves the boundary.
Approved cloud
Specifically authorised tasks routed to force-approved models under policy, with a human gate on egress.
No-AI
Workflows remain fully operational without any generative AI in the loop.
See Governed AI › for the full model-governance and audit picture.
What your CIO and information-assurance team will ask.
Can Trace Intel see our case data?
Not under routine operation. The platform is designed so support, diagnostics and updates do not require access to operational data; any exceptional, supervised access is force-initiated, time-limited and logged.
Where do our encryption keys live?
Under force control. Trace Intel does not hold or manage force encryption keys.
Can we run this fully air-gapped?
Yes, for deployments where policy requires no routine external network path. Updates are delivered through the force's own controlled import process.
What happens if we stop paying for assurance?
The deployed platform keeps operating. It stops receiving new security updates, connector maintenance and new releases until assurance is reinstated.
Does AI use send our data outside the boundary?
Only if a human explicitly authorises a request through the approved-cloud route under policy. Local mode and no-AI mode never send data outside the boundary.
Who can prove the audit trail hasn't been altered?
The audit log is hash-chained and tamper-evident by design; alteration is detectable, and the force can independently verify the chain as part of its own review process.
Which jurisdictions are supported?
Configurable jurisdiction packs cover England & Wales, Bermuda, the Cayman Islands, Anguilla and Jamaica, alongside US federal practice, with packs for the British Virgin Islands and the US Virgin Islands being stood up as configurable packs rather than certified compliance. Each deploys inside that jurisdiction's own infrastructure under the sovereignty model.
Bring your assurance team to a briefing.
Walk through deployment models, data flows and the vendor-access model against your own accreditation requirements.