TraceLock privacy
Privacy Policy
Last updated: July 24, 2026
Six Sense Enterprise Services LLC, operating TraceLock under the Odingard brand, provides continuous control monitoring and evidence workflows for organizations. This policy explains what we collect, why we use it, and the choices available to you.
Information we collect
Account and identity data. When you create or access a workspace, TraceLock processes identity and account information such as your name, business email address, organization membership, role, authentication events, and service-account or API-key metadata.
Connector telemetry and evidence metadata. When you connect GitHub, Google Cloud, Azure, identity providers, or other systems, TraceLock processes the configuration and telemetry needed to evaluate controls. Evidence records may include provider, event type, timestamps, hashes, control mappings, retention dates, and payload size. TraceLock is designed to retain evidence metadata and hashes rather than unnecessary personal content.
Usage and device data. We collect product usage, diagnostic, security, and audit events such as pages visited, feature activity, approximate timestamps, browser or device information, and IP address or request metadata where needed to secure and operate the service.
How we use information
- Provide, maintain, and improve TraceLock workspaces, monitoring, Trust Centers, and auditor workflows.
- Authenticate users, enforce tenant membership and role permissions, and prevent abuse or unauthorized access.
- Ingest connector telemetry, evaluate controls, generate alerts, and preserve an auditable evidence trail.
- Process subscriptions, invoices, and payments through Stripe and communicate operational or support information.
- Measure reliability and product performance, troubleshoot incidents, and meet legal or regulatory obligations.
Retention and deletion
Workspace administrators control much of the organization’s data lifecycle. Evidence records configured for regulatory retention may be protected by a seven-year SEC 204-2-style WORM retention clock and cannot be altered or deleted before the clock expires, including when an account is closed, unless applicable law requires otherwise. Other account, telemetry, and support data is retained only as long as needed for the purposes described here, contractual requirements, security investigations, and legitimate backup cycles.
Sharing and subprocessors
We do not sell personal information. We share information only as needed to operate TraceLock, at your direction, or as required by law. Service providers may include cloud hosting, databases, monitoring, email delivery, identity infrastructure, and Stripe for payment processing. Providers are authorized to process information only for the services they provide and are expected to maintain appropriate safeguards. We may disclose information to protect users, investigate security incidents, enforce our terms, or comply with a lawful request.
Security and tenant isolation
TraceLock uses encryption in transit, protected credential handling, role-based access controls, tenant-scoped authorization, audit logging, and operational safeguards designed to keep one organization’s data separate from another’s. No online service can guarantee absolute security, so please notify us promptly of suspected unauthorized access.
Your rights
Depending on where you live, you may have rights to access, correct, export, restrict, object to, or delete personal information, and to withdraw consent where processing is based on consent. Residents of the European Economic Area and the United Kingdom may have rights under GDPR; California residents may have rights under CCPA and related laws. Requests should be sent to support@odingard.com. We may verify your identity and coordinate with your organization administrator before completing a request.
Contact
Questions about this policy or our privacy practices can be sent to support@odingard.com. TraceLock is operated by Six Sense Enterprise Services LLC, doing business under the Odingard brand.