IT and security
Easy to approve, easy to support.
InfoSec reads every word, so this page says what MaxTrax 8 does today and, just as plainly, what it does not.
Use your browser's print command to save this page as a PDF.Send us your questionnaire
Where it runs
Three ways to run it. The same product in each.
Hosted by CSDS
We run your site on Microsoft Azure App Service with its own SQL database. Secrets sit in Azure Key Vault, read by the app's managed identity.
Or in your own Azure subscription
The same Azure App Service and Azure SQL Database, in a subscription you own, so you choose the subscription and the region. Installing and upgrading is the same .zip file as on a server.
Or on your own servers
One Windows server with IIS and .NET Framework 4.8.1, and one SQL Server database per site. Installing and upgrading is a .zip file. Your team keeps the database password; never send it to us.
A hard boundary when you need one
A site is one MaxTrax address with its own database. Projects under separate NDAs can each have their own site.
Sized by memory
One or a few projects: 2 CPU cores and 8 GB of memory. Many users, large imports and weekly reports: 4 cores and 16 GB.
Help for your installer
The install guides are public.
MaxTrax Help has the server requirements, the install and upgrade steps, single sign-on set-up and the support bundle, the same pages your administrator sees in the app. Read them before you talk to us.
What leaves your network
On your own servers, nothing comes to us.
One outbound connection
A self-hosted site makes no connection to CSDS. The only connection it opens is to the SMTP server you configure. With none set, it sends no email.
No AI, no tracking
MaxTrax 8 uses no AI, machine learning or third-party tracking, and makes no automated decisions about a person's employment. Its quality checks are rules you can read.
Support on your terms
When you need our help, an administrator downloads a support bundle: one zip of warnings and errors with personal details already replaced. You read it, then decide whether to send it.
Sign-in and access
Your directory proves who someone is.
Single sign-on
Sign in with Microsoft Entra ID, Google Workspace or another OpenID Connect provider such as Okta. MaxTrax passwords keep working beside it, for contractors outside your directory.
No surprise accounts
Sign-on creates no users. An administrator adds each person with a role and projects, and the first sign-in links that user to one work account.
Passwords, when used
Stored as PBKDF2-HMAC-SHA256 with 210,000 iterations. Three failed sign-ins lock the account for 15 minutes. An administrator lock lasts until someone lifts it.
Each role sees its own projects
A person sees only the projects and contractors their role allows, NDE contractors included.
An audit trail of every change
From 8.0, every record and setting: who changed it, when, and the old and new values, including role changes. Refused sign-ins are logged with their source address.
Not yet
Where MaxTrax 8 goes next on security.
These are not in MaxTrax 8 today. Each one can be built, and the ones clients ask for first come first. Tell us which matters to you.
Not yet, and planned or open to your say
- Users from your directory (SCIM): planned
- A public API for your other systems: planned for early 2027
- Multi-factor sign-in of its own: today your SSO provider's applies, and we can add our own if you need it
- Password history, blocking a reused password: open to demand
Certifications
- ISO/IEC 27001 and SOC 2 Type 2: planned for CSDS-hosted MaxTrax, with the process starting in 2027
- We hold no certificate today, and we will not claim one until it is issued
The planned items are on What's next. Dates are our aim, not a promise.Tell us what your security review needs.
Bring your security questionnaire.
We answer it in writing, with the release each answer applies to. Ask for our server requirements and security documents too.