Skip to main content
Traversal is built on a foundation of strict data privacy. Your data is never shared with other customers, never used to train models, and processed only as needed to provide Traversal’s services to your organization, as described in your customer agreement.

​
Core privacy principles

No cross-customer use of identifiable data

Unless otherwise agreed to by you, your identifiable data is never used for cross-customer training, model improvement, or service optimization.

In-context processing

Unless otherwise agreed to by you, any data processing is limited to in-context use for your organization, and data from your investigations does not leave your context other than to Traversal’s sub-processors as needed to provide the services as described in your customer agreement.

Tenant isolation

All customer data is protected through tenant isolation, access controls, and privacy safeguards. Multi-tenant SaaS uses logical isolation, while single-tenant SaaS and BYOC run on dedicated infrastructure (see deployment options).

Read-only by default

Traversal cannot modify your systems or data unless you explicitly authorize it to. Integrations use read-only access by default.

​
Compliance alignment

Traversal aligns with the following compliance frameworks: Traversal also undergoes regular third-party penetration testing.
Visit the Traversal Trust Center to request compliance reports or review security documentation.

​
What data Traversal accesses

Traversal only accesses what is necessary to perform investigations. Access is read-only unless you explicitly grant Traversal broader permissions.
No agents are deployed in your environment. Traversal operates without sidecars or background processes running in your infrastructure.

​
Observability data

Traversal reads metrics, logs, traces, and alerts from your connected observability tools. This data is used in-context to perform root cause analysis and is retained only as needed to provide services to your organization, in accordance with your customer agreement.

​
Code repositories

Traversal requests read-only access to your repositories to correlate deployment events and code diffs with incidents. When an investigation needs more context, Traversal may check out an allowed repository in an ephemeral sandbox to search and analyze the wider codebase. By default, Traversal rejects writes to your repositories. Traversal can only make changes to your code if you explicitly grant it write access.

​
Knowledge and productivity tools

Traversal reads documentation and tickets from tools such as Confluence, Notion, Jira, Linear, and ServiceNow. It uses them to surface runbooks, procedures, and postmortems during investigations, to correlate incidents with engineering work, and to build your organization’s Traversal Wiki.
  • Documentation — pages, spaces, and databases (Confluence, Notion), and knowledge base articles (ServiceNow).
  • Tickets and work items — issues, comments, status, assignees, and attachments (Jira, Linear), and incidents and change requests (ServiceNow).
  • Service context — configuration items and their relationships (ServiceNow CMDB).
You control what Traversal can see through the credentials you provide and the content you share with each integration. For example, Traversal can only read the Notion pages and databases you share with it. See each integration’s setup guide for the exact data and permissions involved.

​
Slack

Traversal runs as a Slack app installed by a workspace administrator, and can only see channels the app has been added to. Within those channels it:
  • Reads conversation context — messages, threads, reactions, pinned items, shared files, and link previews — to understand the incident and any follow-up questions (app_mentions:read, channels:history, groups:history, im:history, mpim:history, channels:read, groups:read, im:read, mpim:read, reactions:read, pins:read, links:read, files:read).
  • Resolves requester identity — display name and email — to attribute requests and reports (users:read, users:read.email).
  • Posts back into Slack — investigation results, replies, reactions, uploaded report files, direct messages, and slash-command responses (chat:write, im:write, reactions:write, files:write, links:write, commands, incoming-webhook).
  • Joins channels it is invited to (channels:join).
These are messaging-surface permissions only. They do not grant Traversal any write or data-plane access to your connected systems.

​
Microsoft Teams

Traversal runs as a Microsoft-approved Teams bot (an Azure AD app plus Azure Bot) installed by a Teams administrator. Your organization decides where it participates — it acts only on mentions, configured triggers, or Workers your team has enabled. In those conversations it:
  • Reads conversation context — the content of messages that mention or trigger the bot, thread context, and channel/team names, plus any attached files or images (ChannelMessage.Read.All, Team.ReadBasic.All, Channel.ReadBasic.All; Chat.Read.All only where 1:1 and group chats are in scope).
  • Resolves requester identity — the sender’s Azure AD user ID, display name, and email — to attribute requests (User.Read.All).
  • Reads membership, where enabled — who belongs to a channel or team (ChannelMember.Read.All, TeamMember.Read.All).
  • Posts back into Teams — authenticates as its registered app and posts investigation results into the originating channel or thread.
These are messaging-surface permissions only. They do not grant Traversal any write or data-plane access to your connected systems.

​
GDPR

Traversal, Inc. is headquartered in the United States. This section describes how Traversal meets its obligations under the EU General Data Protection Regulation (GDPR) and the UK GDPR. For full details, see the Traversal Privacy Policy.

​
Roles

  • Customer Data. When Traversal processes data from your connected systems on your behalf, your organization is the controller and Traversal is the processor. Your customer agreement governs this processing.
  • Account, usage, and business contact data. For account and usage data relating to your users’ access to and use of the services (such as names, email addresses, and login and usage logs), and for data about website visitors and business contacts, Traversal is the controller. The Privacy Policy governs this processing.

​
EU and UK representatives

Traversal has appointed representatives in the EU and the UK under Article 27 of the GDPR and the UK GDPR. Data subjects and supervisory authorities can contact these representatives about any matter related to Traversal’s processing of personal data.

​
Exercise your rights

Depending on where you are located, you may have the right to access, correct, delete, restrict, or port your personal data, and to object to its processing. Where processing relies on your consent, you can withdraw it at any time.
  • If your data is part of Customer Data, contact the organization that uses Traversal. That organization is the controller, and Traversal assists it in responding to your request.
  • For any other personal data, contact Traversal at support@traversal.com, or contact the EU or UK representative listed above.
You also have the right to lodge a complaint with your local data protection supervisory authority. In the UK, this is the Information Commission’s Office. If you are in the UK, you can also lodge a complaint directly to Traversal about how Traversal handles your personal data by contacting support@traversal.com.

​
International transfers

Traversal processes personal data in the United States. For transfers of personal data from the EEA, Switzerland, or the UK, Traversal relies on the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum.

​
Data processing agreement and sub-processors

To request Traversal’s data processing agreement (DPA) or the current list of sub-processors, visit the Traversal Trust Center or contact support@traversal.com.

​
Contact