Core concepts
The core objects in TraceGuard and how they relate.
A quick tour of the nouns you'll see throughout the product and these docs.
Organizations & projects
An organization is your tenant — the top-level boundary that owns data, members, and settings. Data is strictly isolated per organization. Inside an organization you create projects, which usually map to a repository, service, or product. SBOMs, scans, and findings all live under a project.
BOMs
A BOM (Bill of Materials) is the inventory you upload. TraceGuard accepts
CycloneDX and SPDX, across seven BOM types: sbom (software), hbom
(hardware), cbom (cryptography), saas_bom, ai_bom, ml_bom, and obom
(operations).
Components & dependencies
Parsing a BOM produces components (the packages and parts you depend on) and the dependency relationships between them. Components roll up to an organization-wide inventory so you can answer "where is this package used?".
Vulnerabilities, scans & findings
A scan matches your components against vulnerability data and enriches the results with KEV and EPSS. Each match is a finding — a vulnerability in the context of a specific component in a specific project. Findings move through a state machine as you work them.
Decisions, VEX & applicability
- VEX assertions record exploitability: affected, not affected, fixed, or under investigation — with justification.
- Finding decisions / exclusions capture triage outcomes.
- Applicability rules let you express, once, which findings actually apply to your context and govern them at scale.
Assurance & evidence
Assurance turns all of the above into proof: an append-only log, point-in-time snapshots, and exportable evidence bundles, backed by a tamper-evident audit log.