Data Handling and Subprocessors

• Institutional account data: analyst identity, credentials (hashed), institution, role. • Case identifiers (non-PII): wallet addresses, URLs, hostnames, IP addresses, phone numbers, last-4 bank references, and their relationships in the evidence ledger. • Optional victim PII: only when an analyst attaches it. Encrypted at rest, segregated from the tamper-evident ledger, not included in exported packages by default. • Evidence ledger: hash-chained record of case events; SHA-256 fingerprints of exported packages. • Coach transcripts: page context plus analyst messages. No case data is transmitted to the Coach provider.

The following subprocessors support PEGTrace as of the date at the top of this document: • Supabase — hosting and Postgres database, US region. • Anthropic — LLM used by the Coach. Receives only route context and analyst-typed messages; does not receive case data. • Bitquery — on-chain transaction data used by tracing modules. • Have I Been Pwned — email and domain breach-exposure lookup. • IPQS (IPQualityScore) — IP and device intelligence signals. • GoPlus — token and smart-contract risk analysis. • Honeypot.is — smart-contract honeypot detection. • Cloudflare — Turnstile CAPTCHA and edge protection. • Resend — transactional email delivery, where applicable. Subprocessors may change. Material updates will be reflected in this document with a new 'Last updated' date.

• Analyst input flows to Supabase (US region). Victim PII is encrypted at rest. • Trace and enrichment lookups flow to the relevant provider (Bitquery, HIBP, IPQS, GoPlus, Honeypot.is) only for the identifier being analyzed. • Coach messages flow to Anthropic; case data does not. • Exported packages remain within Supabase storage; their SHA-256 fingerprints are recorded in a package registry usable through the public /verify portal without exposing case contents. • CAPTCHA challenges and edge protections flow through Cloudflare.

PEGTrace publishes a public verification portal at /verify. Anyone in possession of an exported package can confirm its SHA-256 fingerprint and existence in the registry without gaining access to the underlying case.

Case data and ledger entries are retained for the life of the institutional account and for a reasonable period afterward to preserve package integrity and to satisfy audit and legal obligations. Victim PII may be deleted on request following institutional review. Deletion of a case's ledger entries is constrained by the tamper-evident design; where legally required, we will document deletions rather than silently remove them.

Encryption in transit (TLS), encryption of victim PII at rest, hashed passwords, role-based access, row-level security, SHA-256 evidence hash-chaining, package fingerprinting, rate limiting, and CAPTCHA on public verification endpoints.

support@pegtrace.com