TraxrGRC

Administrator's Guide

October 2026 · build 244823a

Installing, configuring, securing and operating a TraxrGRC instance.

About this guide

This guide is for the people who install and run TraxrGRC: the administrator who configures users, roles, sign-in and settings in the application, and the operator who runs the server, its backups and its upgrades. In a small team these are often the same person.

Who this guide is for

Application administrators who hold the Administrator role and manage users, groups, roles, single sign-on, settings, notifications, data loading and API access.
Operators who install the platform on a server, keep it backed up, apply upgrades and watch its health. Operator chapters assume you are comfortable with a Linux shell, Docker Compose and a text editor.
Security and audit staff who need to know what the platform enforces, what it records and how to show that the record is intact.

People who use the modules day to day should read the User Manual. New users should start with the Quick Start Guide.

How this guide is organized

Chapter	What it covers
Architecture and Requirements	The components of an instance, how they connect, and what the server needs
Installation	Installing from a release, HTTPS options, the first administrator and the go-live checklist
Configuration Reference	Every environment variable and where each setting lives
Users, Groups and Roles	Accounts, groups, roles and permissions, own and all scope, separation of duties
Authentication and Single Sign-On	Passwords, throttling, LDAP, SAML, SCIM provisioning and sessions
Platform Settings	Every Settings page: branding, labels, custom fields and the module settings
Notifications and Email	SMTP, templates, rules, the scheduler, scheduled reports and the delivery log
Loading and Importing Data	CSV imports, framework packages, the bundle loader, first-time migration and demo data
API Access and Integrations	API tokens, the REST API, AI assistants (MCP) and service accounts
Audit Log and Evidence Integrity	What is logged, the Audit Log page and the tamper-evident hash chain
Backup and Restore	Server backups, in-app snapshots and a restore drill
Upgrades	Applying a new release, what the update checks, and rolling back
Monitoring and Troubleshooting	Health checks, logs, chain verification and fixes for common failures
Security Hardening	What the platform enforces and the operator's checklist

A first installation follows the chapters in order through Platform Settings. After go-live, the last four chapters are the routine.

Conventions

Convention	Meaning
Bold	A label you see on screen: a menu entry, page title, tab, button, field or status, written exactly as it appears.
Settings → Integrations	A navigation path: open Settings in the sidebar, then Integrations.
`monospace`	Text you type or read literally: addresses, file names, commands, environment variables, permission names and API values.
`module:right`	A permission, for example `settings:update` (Update on the Settings module).
own and all	The two levels at which a role can hold a right; see Users, Groups and Roles.
Command blocks	Commands to run on the server, from the instance directory (the one holding `docker-compose.yml`) unless the text says otherwise.

Settings pages. Every Settings page has a card on the Settings page, and each card is shown only to people the page itself admits. The sidebar's Settings entry appears for anyone who can open at least one of them. Each chapter also gives the page's address.

Screenshots show a demonstration installation with fictional data for an invented company, Quillmont Systems. Your product name, logo and data will differ.

About this guide

Who this guide is for

How this guide is organized

Conventions

Contents