1. What Traces is
Traces is a managed digital evidence collection service operating in the United Kingdom. A client — normally a law firm, an in-house legal team or a workplace investigator — instructs Traces to collect electronic records relevant to a dispute or investigation. Traces collects those records from systems the client or the client's own client controls, records how the collection was carried out, and delivers the result as a sealed bundle.
Traces does not advise on the law, does not decide what the evidence means, and does not represent any party.
Two stages, priced separately:
Collection. Obtaining the records and sealing them. Fixed fee per matter.
Analysis. Working on records already collected — searching a mailbox, or comparing two codebases. Commissioned separately and only where a matter needs it.
2. Services
2.1 Mailbox collection
Whole email accounts from Microsoft 365 and Google Workspace, across one or more named custodians. Collected through the providers' own programmatic interfaces rather than by exporting from the user interface.
Standard scope is Inbox and Sent Items. On request: Deleted Items, Junk, Drafts, recoverable items, named folders, or all folders.
Delivered as EML files arranged by original folder, with attachments in native format.
2.2 Repository collection
Source code repositories with full commit history, from GitHub and Bitbucket.
Delivered as a full mirror of each repository, openable with standard Git tooling.
2.3 Systems collection
Workplace systems that expose a usable programmatic interface — Slack, Jira, Notion, Okta and similar. Eleven connectors are recorded as built: Bitbucket, GitHub REST v3, GitLab, Jira Cloud, Trello, Notion, Slack Web API, Discord HTTP, Okta Admin Management, Auth0 Management, Clerk Backend.
Delivered as structured data with files and attachments in native format.
2.4 Mailbox search
Applies client-supplied search terms and date ranges to a mailbox Traces has already collected, and returns only matching material with threads kept whole. Runs against the sealed collection, never against a live account.
2.5 Code comparison
Compares two collected codebases and reports shared material, its extent, and what the commit history shows about when each version appeared. Reports findings; does not determine whether copying occurred as a matter of law.
3. Access model
This section matters most for the privacy notice, because it determines whose data Traces can reach and on whose authority.
3.1 Microsoft 365 and Google Workspace
Traces requests tenant-wide read access via the provider's own consent mechanism. A person holding Global Administrator rights in the tenant receives a link from Traces, sees what is being requested, and approves it. They can revoke it at any time.
Two things follow, and both need to be accurate in the privacy notice:
The grant is technically broad. Once given, it permits read access to every mailbox in the tenant and to basic directory details of every user.
A manual alternative exists, in which the administrator configures narrower access directly. Traces' position is that this is more error-prone.
3.2 Repositories
An organisation owner or workspace admin installs the Traces application, which requests read-only access.
3.3 Other systems
Varies by platform. In each case an administrator approves read access through the platform's own authorisation screen and can withdraw it. Some platforms permit scoping to named channels, projects or workspaces; some do not.
4. Personal data involved
Traces does not choose what personal data it encounters; it is determined by the systems in scope. In practice a collection will routinely include:
Content data — the substance of emails, messages, documents, attachments and code, including anything personal that happens to be in them
Communications metadata — senders, recipients, timestamps, subject lines, message IDs, folder locations
Identity and directory data — names, work email addresses, usernames, account identifiers, and in repositories the author and committer names and email addresses attached to each commit
Activity records — access logs, edit history, permission changes, where the platform exposes them
Special category data may be present incidentally. A grievance investigation mailbox may contain health information, trade union membership, or data about sexual life or beliefs. Traces does not seek it and cannot exclude it in advance, because it is not knowable before collection. This needs an explicit position in the privacy notice and probably in the DPA.
Data subjects are not the client. The people whose data is collected are custodians, their correspondents, and third parties who appear incidentally — none of whom have a relationship with Traces and most of whom will not know a collection has occurred. Article 14 rather than Article 13 applies, and the disproportionate-effort exemption is likely to be relevant. This is a question for the solicitor, not for us.
5. Controller and processor roles
Content Design's understanding, offered for correction rather than as a position:
The instructing client determines the purposes — which custodians, which date ranges, what is being investigated. That points to the client as controller.
Traces determines the technical means of collection and the methodology, and holds a professional obligation to collect defensibly rather than as instructed. That is not a pure processor posture.
Traces additionally processes some data for its own purposes — engagement records, billing, and the obligation to be able to stand behind its own method for six years. That is controller activity on the same underlying facts.
Likely a processor for the collected evidence and a controller for the engagement record, but that is a legal determination. Flagging it because the two retention periods in section 6 only make sense if the roles are split this way.
6. Retention
Two separate things, deliberately kept separate:
Collected evidence — 90 days. Traces holds the delivered bundle for 90 days after the client confirms download, then deletes it. The client may request earlier deletion at any time. This is a commercial choice, not a legal requirement.
Engagement records — six years. Who instructed Traces, what was asked for, what was done, and the methodology followed. Retained in line with the usual limitation period so that the collection can be explained if challenged later. This does not include the collected evidence itself.
7. Delivery and security
Collections are delivered as a password-protected ZIP archive. The password is sent by a separate channel, typically SMS. The download link is single-use; further links are issued on request.
9. Forensic method
9.1 Integrity
Every collected file is hashed with SHA-256 at the point of capture. The hash list is delivered with the bundle as a CSV, so any exhibit can later be checked against the file as collected.
Custody records are append-only tables with a per-artifact hash. They are not a hash chain, and must never be described as "blockchain-style" or as cryptographically linked. An in-database hash chain with external anchoring has been assessed and recommended but is not implemented. The honest present-tense description is per-file hashing plus an append-only log.
Recorded internal finding: the Systems connector line stores re-serialised JSON derived from the platform response rather than raw wire bytes, which is lossy relative to the original. This is a material fact about what "the evidence exactly as we collected it" means for that service line and should be disclosed rather than glossed.
Recorded internal finding: the decision-event log has no cryptographic linkage between events.
9.2 Repeatability
The chain of custody is intended to establish that the collection is repeatable — that someone following the same steps at the same time would obtain the same data. The temporal qualifier is load-bearing and deliberate: cloud systems are moving targets, and a collection performed a month later would not return identical results.
9.3 Standards
The method follows the principles set out in ACPO/NPCC guidance on digital evidence, ISO/IEC 27037 and BS 10008. Alignment with published principles, not certified compliance — the distinction is deliberate and should not be strengthened in any client-facing document.
ACPO Principle 3 has been assessed internally as inapplicable to cloud collection, on the basis that the data is a moving target and acquisition is methodology-dependent. This is a defensible position that has been reasoned through, and it is the kind of thing an opposing expert would probe.
9.4 Capability ceilings
Traces' stated practice is that every platform carries a maximum amount of evidence legitimately obtainable, that this ceiling is assessed before instruction, and that anything which could not be reached is recorded in the delivered bundle rather than omitted.
The binding constraint is usually history retention rather than interface availability. Platforms commonly expose far less history programmatically than they display on screen, licence tier affects what is reachable, and licence upgrades are not retroactive.
10. What Traces does not do
Advise on the law, or on whether evidence is admissible
Collect from systems the client or their client does not control
Collect from platforms with no usable programmatic interface, including consumer messaging services such as WhatsApp
Collect another party's social media content
Determine whether copying, wrongdoing or liability occurred
Represent a party, or produce partisan findings