How We Protect Your Data

Last updated October 20, 2026

This page describes the technical measures TraceForge actually has in place today. It is not a certification or an audit result — if your agency needs to document specific compliance requirements (for an examiner, a client contract, or your own policy), contact us and we’ll work through it directly.

Encryption

Social Security numbers, outside database passwords, your agency’s email mailbox password and any skip-trace provider credentials are encrypted (AES-256-GCM) before they’re stored, using a key that is never stored alongside the data itself. All traffic to and from TraceForge travels over HTTPS. Card and bank account numbers are not stored in TraceForge.

Access Control

Inside your agency, every user is a Point Caller, Closer or Admin, and each role only sees and does what it needs to: Point Callers work their own queues, Closers also take payments and see reports, and only Admins see hours, settings and imports. These checks run on the server for every request, not just in the screens.

Passwords are hashed using industry-standard methods and are never stored, or visible to us, in plain text. Sessions automatically log out after an hour of inactivity.

Data Isolation Between Agencies

Each agency’s collections data is kept in its own separate database, with its own database login that can open that database and nothing else. One agency’s login cannot connect to another agency’s database at all, so a mistake in one place can’t show your accounts to someone else. Each agency’s outside database connection (such as CollectionsMax) is stored separately too.

Backups

Every agency’s database is backed up automatically every night. Backups are encrypted (AES-256-GCM) before they leave the server and are copied to separate cloud storage (Cloudflare R2), so losing the server doesn’t lose your data. Copies are kept for 30 days, and restores are tested by loading a backup into a throw-away database and checking it against the live one. We’re alerted by email if a backup ever fails.

Audit Trail

Every action every user takes — opening an account, adding a note, calling, changing a status, taking or changing a payment, assigning work — is logged with who did it and when. Admins can see it in Hours & activity. Anything sent back to CollectionsMax is backed up first so it can be undone.

Calling Safeguards

By default TraceForge blocks calls outside the consumer’s local calling hours, checks a phone’s area code against the consumer’s state before adding it, and shows staff an electronic-monitoring notice they must accept. These are aids, not a guarantee of compliance.

Payments

Your TraceForge subscription is billed through Stripe, a PCI-DSS Level 1 certified provider; TraceForge never receives or stores your card details. Consumer payments are recorded in TraceForge without card or bank numbers, and are charged through your own merchant account.

Questions

If you have a specific security or compliance question — including anything related to FCRA, FDCPA, or GLBA obligations around the data you manage — email us and we’ll answer directly rather than pointing you at a generic policy.