SECURITY BY DESIGN

Security & Trust

Private source, server-side authority, tenant isolation, verified payment state, reproducible releases, fail-closed capability gates, and customer-controlled account security.

Trust Center Data Governance Security contact

Source containment

Private repository. Proprietary authority/engine modules are server-only and client/server import boundaries are tested in CI.

Tenant isolation

Supabase RLS, explicit membership checks, private object storage and exact browser privilege closure limit tenant data paths.

Authentication + sessions

Supabase claims establish identity; MFA/AAL2 is required for high-authority paths. Signed-in customers can revoke all other sessions while keeping the current browser active. Compromised-password protection and Production session policy remain explicit Auth release gates.

Browser hardening

Cross-site mutations are rejected before handlers. Sensitive dynamic customer/authority surfaces use a per-request nonce CSP; the public shell remains cacheable behind its separate baseline CSP.

Supply chain

Locked dependencies, restricted install scripts, Dependabot, secret scanning, boundary checks and retained CycloneDX SBOM/lockfile evidence are part of the release workflow.

Recovery + evidence

Server-generated correlation IDs, minimized logs, backups, restore tests, incident response, rollback, immutable releases and supersession are treated as operational controls—not marketing badges.

SHARED RESPONSIBILITY

Security is strongest when the platform and the customer each control the right layer.

METRAXIOM secures the application controls it operates. Customers remain responsible for the people, devices, source authorization, quality-system configuration, and external systems they control.

METRAXIOMApplication security boundaries, tenant RLS, protected server credentials, release controls, audit/evidence integrity, platform monitoring, dependency controls, and documented incident/restore processes within the service boundary.

Customer organizationWorkspace roles and invitations, user offboarding, MFA use where required, approved methods/source rights, instrument identity quality, data classification, and determining which records belong in the service.

Device + integration environmentSecurity of Device Bridge hosts, lab networks, vendor drivers, integration credentials, physical instruments, connected gateways, and customer-controlled systems outside METRAXIOM.

Measurement authorityThe customer quality system determines applicable procedures, acceptance criteria, validation obligations, competent review, and whether a METRAXIOM record may be relied upon for a particular regulated or contractual use.

SECURITY REPORTING

Report a suspected vulnerabilityANDREWATTS23@gmail.comInclude the affected route/component, observed behavior, reproduction steps and impact if safe to provide. Do not email passwords, API keys, payment-card information or unnecessary customer-controlled evidence.

No badge inflation.

Using security-capable vendors or aligning controls to OWASP/CISA practices does not make METRAXIOM SOC 2 certified, government approved, independently penetration-tested or otherwise assured unless a specific retained assessment establishes that claim.

System Status Trust Center

Automatic counts. No individual tracking.

TRACE counts approved public page requests worldwide without an analytics consent banner. No visitor identifiers, fingerprints, individual browsing histories or GPS locations are collected.

Analytics privacy update · October 29, 2026

TRACE automatically measures aggregate requests to approved public METRAXIOM pages worldwide to improve content, navigation and reliability. It runs at the first-party hosting proxy, before the hosting page cache, and works when JavaScript is disabled. No analytics consent banner or country-based opt-in selection is used.

The basic store contains separate hourly totals for approved pages, country and US-state labels, common referral domains, broad device/browser/operating-system families and unverified request categories. It contains no individual request ledger, full IP addresses, raw user agents, full URLs or queries, visitor identifiers, fingerprints, session histories or GPS coordinates. Country labels come from hosting network metadata and can describe a VPN or network exit. Missing geography is recorded as unavailable. No city, address or coordinates are collected. US-state labels come only from the trusted hosting header; other state/region labels remain unavailable. Software names are broad, spoofable claims, with no versions or cross-request fingerprint.

GPC, DNT and an explicit traffic objection stop collection. Earlier “Keep analytics off” choices saved only in browser storage are carried forward as objections when JavaScript runs on a public application page. They are not sent with the initial HTTP request: that request, JavaScript-disabled requests and static-only visits may contribute until an objection cookie or privacy signal is sent. Exclude this browser from traffic measurement without an account or JavaScript. The preference cookie uses the same value for everyone who excludes traffic (1) or explicitly restores basic measurement (0), lasts up to 180 days and does not identify you. Restoring basic measurement preserves the old local choice; it can apply again after the restore preference expires or is cleared. Restoring aggregate measurement does not override privacy signals or grant individual tracking permission. Earlier aggregate counts cannot be linked back to you or selectively removed.

When you choose a dashboard view, a separate functional reporting-preference cookie remembers only the preset or calendar dates for up to 30 days, scoped to /traffic. It is not used by the collection layer and contains no identifier or consent grant. Use Forget saved reporting view, including without JavaScript, to remove it. A failed refresh may display a clearly dated snapshot held briefly in page memory; it is never relabeled as current or replaced with fabricated zero counts.

Individual browser analytics is disabled in this aggregate-only rollout. The former optional browser collector is not loaded, its intake is retired, and no new tab/session events are accepted. Earlier consent records are not rewritten as new permission. Previously collected optional events follow their existing 30-day retention and integrity-checkpoint policy.

Page requests are separate from verified page rendering or unique people. Navigation requests, crawler claims, link previews, other automation and unknown requests remain separate. Estimated visitors and session histories are unavailable. Small labeled groups are combined in public reports. Counts are aggregate observations and do not establish identity, intent or endorsement.

Recognized health checks, HEAD requests, prefetches, server-component fetches and private/API/unapproved paths are excluded. Browser memory/disk cache, back-forward restores, client-only navigation, privacy objections, missing metadata and storage failures leave coverage gaps. Request retries and spoofed software labels can affect totals. The system does not extrapolate missed traffic or import historical Vercel Analytics counts.

Hourly counter buckets are retained for 30 days and pruned hourly in bounded runs; calendar reports exclude older hourly data even if maintenance is delayed. Separate cumulative marginal totals, with no event times or cross-dimension links, remain for the life of the site’s traffic record. Changing a date range, leaving the page or closing a browser does not erase those totals. Earlier uncollected state/software labels remain unavailable, not reconstructed. Vercel delivers the website and Supabase stores TRACE aggregates in the existing United States database. Provider security logs and backups have separate policies. TRACE adds no paid analytics feed or operator-computer dependency.

This October 29, 2026 supplement updates the analytics description in the September 7, 2026 Privacy Notice. It does not amend frozen agreement snapshots or claim that server-side processing is automatically exempt from privacy law. The assessment concerns this limited data flow and its controls; no universal regulatory approval is claimed. Privacy requests: ANDREWATTS23@gmail.com.