A privacy policy may say personal data can be deleted.
But:
- Can the organisation find every relevant copy?
- Does deletion propagate to connected systems?
- Are backups handled according to policy?
- Is there evidence that the request was executed?
TRACE ENGINEERING ASSURANCE
Know what your public engineering surface reveals.
Map the public-facing engineering evidence of your organisation in under 60 seconds.
See what TRACE can observe, what supports DPDP readiness, and what still requires verification from inside your systems.
Learn how TRACE worksWHAT HAPPENS NEXT
The scanner is the start of TRACE, not the whole product.
01
Map the public surface
TRACE inspects publicly observable website, DNS, TLS, privacy and data-collection signals.
02
Understand the evidence
See Surface Assurance and DPDP Public Evidence Coverage.
03
Verify what cannot be seen
Complete Internal Readiness and request an Engineering Audit where internal controls need proof.
01 / THE ENGINEERING GAP
Your policies may be correct.But do your systems enforce them?
Governance describes intent. Engineering determines whether that intent is actually implemented. TRACE focuses on the engineering reality underneath compliance — not the policy binder.
A security policy may require access restrictions.
But:
- Is MFA actually enabled?
- Are terminated users really deactivated?
- Can privileged accounts bypass intended controls?
- Is there evidence showing the current configuration?
A retention policy may specify deletion after a period.
But:
- Is the retention job running?
- Which systems implement it?
- Are downstream vendors included?
- Can execution be demonstrated?
TRACE focuses on the engineering reality underneath compliance. The examples above illustrate the class of questions an assessment examines. They are not a claim that every check is already automated in the product today.
02 / HOW ORGANISATIONS BEGIN
Assessment first. Software second.
TRACE is not something an organisation needs to purchase on day one. 7Unit first establishes whether engineering controls can be proved — then deploys TRACE where continuous assurance is valuable.
01
Assess
7Unit performs an Engineering Assurance Assessment across the organisation’s relevant digital systems.
02
Validate
Controls are technically examined against the applicable privacy, security and compliance requirements.
03
Remediate
Engineering gaps are prioritised and can be fixed by the customer’s team, partners or 7Unit.
04
Deploy TRACE
TRACE is configured around the organisation’s actual systems, controls, principals, assets and evidence requirements.
05
Continuously assure
TRACE continuously collects evidence, monitors control state and supports ongoing assurance.
03 / ENGINEERING ASSURANCE
A method for proving what systems actually do
Engineering Assurance verifies whether production systems, applications, integrations and operational controls actually implement the privacy, security and compliance obligations an organisation has committed to — and generates evidence to demonstrate what was observed.
01
Discover
Understand systems, data, vendors, infrastructure and business processes.
02
Surface
Identify where personal and sensitive information enters, moves, resides and leaves.
03
Validate
Test whether relevant engineering and operational controls behave as expected.
04
Evidence
Capture observations, configuration, attestations and technical evidence with provenance.
05
Remediate
Turn identified gaps into actionable engineering work.
06
Continuously assure
Use TRACE to maintain visibility and evidence as systems change.
04 / WHAT TRACE DOES
The platform that makes assurance continuous
Policies describe what should happen. TRACE helps prove what your systems actually do — by holding principals, surfaces, rights activity and evidence in one operating layer.
Evidence Ledger
Every meaningful assurance action should leave evidence.
The ledger is append-oriented. Each record carries provenance, a timestamp and enough context to show what was observed, configured or attested — and to export that trail for review.
- Append-oriented evidence records
- Provenance for each observation
- Timestamps for control activity
- Control observations
- Exports for review and reporting
- Traceability across related actions
TRACE records evidence with provenance. It does not claim cryptographic immutability.
Principal 360
An evidence-backed view of a data principal and associated privacy activity — identity associations, consent history, notices, processing relationships, rights activity and evidence exports.
- Identity associations
- Consent history
- Notices
- Processing relationships
- Rights activity
- Evidence exports
Surface
Understand observable digital surfaces and the systems that interact with personal information. Surface findings are evidence-backed rather than merely questionnaire-driven.
Rights
Track principal rights operationally — request intake, execution across relevant systems, and the evidence that a right was actioned. TRACE does not replace legal interpretation of those rights.
Connectors
Production intelligence is being introduced through a Connector Framework, Integration Registry, Connector Health, a Connector Capability Model and custom API execution. Production connectors are being progressively introduced.
- Connector Framework
- Integration Registry
- Connector Health
- Connector Capability Model
- Custom API execution
ZohoHubSpotSalesforceGoogleMicrosoftAWS
Named systems indicate the architecture direction for evidence-backed connector execution. They are not presented as generally available production connectors.
05 / EVIDENCE PHILOSOPHY
Evidence should say what we actually know.
TRACE should never convert an assumption into a technical fact. Status is only as strong as the kind of evidence behind it.
Observed
TRACE or the engineering assessment directly observed the state.
Configured
A required control or expected behaviour has been configured in TRACE.
Attested
A responsible person or organisation has formally asserted something that cannot yet be technically observed.
This is how TRACE stays distinct from compliance dashboards that show green status based purely on questionnaires.
06 / ASSURANCE FRAMEWORKS
One engineering reality. Multiple compliance frameworks.
Organisations often operate against overlapping privacy, security and compliance requirements. TRACE’s assurance architecture is being designed so the same engineering evidence can support multiple regulatory and assurance frameworks instead of forcing organisations to duplicate evidence across separate compliance programmes.
Current focus
India DPDP
Architecture direction
ISO 27001
Architecture direction
SOC 2
Architecture direction
GDPR
Architecture direction
HIPAA
Architecture direction
PCI DSS
India DPDP is the current primary regulatory focus. The other frameworks describe the architecture direction for assurance expansion — not a claim that those packs are fully implemented today, and not a claim of certification coverage.
07 / CREDIBILITY
TRACE does not certify your organisation.
Certification and legal interpretation remain the responsibility of qualified auditors, assessors, legal professionals and certification bodies. TRACE does not replace ISO consultants, auditors, legal counsel, DPOs or certification bodies.
TRACE provides something different: engineering visibility and evidence showing whether relevant digital controls appear to be implemented and operating.
08 / FROM THE FIELD
What engineering assessments reveal.
Privacy and security gaps rarely appear as missing policies alone. They show up in how real systems move data, enforce authority and produce evidence.
FIELD INSIGHT · HEALTHCARE
Privacy risk lives between systems
Patient information rarely stays inside a single healthcare application. The harder assurance problem is proving how data, access and controls behave as information moves between registration, clinical, communication, billing and third-party systems.
Read insight →FIELD INSIGHT · EDTECH
A checkbox is not a consent system
Consent becomes an engineering problem when organisations need to demonstrate who authorised processing, what notice applied, whose data was covered and how that authority propagated through downstream systems.
Read insight →09 / WHY 7UNIT
Built by engineers because compliance eventually reaches engineering.
Most compliance programmes eventually produce technical requirements. Traditional consultants can identify some of these issues. 7Unit is an engineering company, so it can continue into implementation.
- Change authentication
- Restrict access
- Encrypt data
- Retain evidence
- Modify an API
- Remove PII from logs
- Implement deletion
- Change cloud configuration
- Connect systems
- Automate retention
- Redesign consent flows
Assess. Prove. Fix. Continuously verify.
PRODUCT LADDER
Surface first. Proof next. Continuous after that.
Surface Assessment
What can the internet already reveal?
Engineering Audit
What do the internal systems actually do?
TRACE OS
Can the organisation continuously prove it?
10 / START HERE
Don’t start with another platform.Start by finding out whether your engineering can prove what your organisation already promises.
Book an Engineering Assurance Assessment7Unit will review the relevant systems, data flows and engineering controls, identify evidence gaps and provide a prioritised remediation roadmap.
Learn about the assessmentTRACE is an Engineering Assurance platform built by 7Unit. It verifies whether relevant digital controls appear to be implemented and operating, and collects evidence that can support privacy, security and compliance assurance. This assessment is a technical and operational readiness product built by the 7Unit engineering team, not a legal opinion or statutory certification. It does not constitute legal advice or representation. It does not guarantee compliance, security, or certification.