Skip to content
Robotics infrastructure · USA · EU

The quiet layer behind reliable robots.

Open tools and independent audits for robot recordings, training data and software supply chains. We handle the behind-the-scenes checks, so your team can keep building robots.

Check a recording, free → See services
  • 0 bytes uploaded
  • 10 contract checks
  • zstd · lz4 chunks
  • Multi-GB streaming
Built for
  • ROS 2 & MCAP
  • Robot-learning data buyers
  • AMR & manipulator makers
  • Teams selling into the EU
Free & open source · Apache-2.0

Backplane Tracecheck

Check MCAP robot recordings against a written recording contract: required topics, schemas, metadata, rates, gaps, timestamp regressions, sequence breaks and time coverage. Every finding points to the exact byte offset as evidence.

Files stay on your machine

The web app reads your file in slices inside a browser worker. Nothing is uploaded, and the site's security policy blocks outside connections.

Multi-GB, streamed

Recordings are streamed with SHA-256 and CRC checks computed on the fly. No file-size cap. Memory use is bounded by explicit limits.

zstd & lz4, bomb-safe

Compressed chunks are decoded with output strictly capped at the declared size. Malicious "decompression bombs" are rejected, not expanded.

Fast mode

Reads only the file summary for an instant inventory, message counts, schemas and metadata check. It falls back to a full scan if the summary is missing.

Evidence, not opinions

JSON and HTML reports pin each finding to chunk and message offsets, and include a contract hash and file hash, ready for a vendor dispute or an audit trail.

CLI for pipelines

The same checks run as a Python CLI with CI-friendly exit codes. Browser and CLI produce identical JSON reports for the same inputs.

Run it in CI

Python 3.11+. Exit code 0 means pass, 1 means findings, 2 means an input or configuration error.

View on GitHub →
$ pip install backplane-tracecheck
$ tracecheck check recording.mcap \
--contract contract.json --out report/
# --fast · --ignore-missing-crc · --fail-on fail · --timeout 600
Services

Free tools in front. Expert work behind them.

Every paid service starts from an open tool you can inspect and run yourself. You pay for neutrality, judgment and deadlines met, not for lock-in.

Data Acceptance Audits

Buying robot training data? We audit each vendor delivery against your acceptance contract, independently, and report which demonstrations you should pay for.

  • You write the rules: topics, rates, sync tolerances, metadata, zero-drop limits
  • Acceptance yield per batch: accepted vs rejected episodes, with reasons
  • Byte-level evidence for every rejection, so vendor disputes are quick
  • Neutral third party: we don't sell data and we don't build competing models
  • Pilot batches of 10–25 demonstrations to calibrate contracts before scale-up
Scope an audit →
batch_07 · vendor delivery review
87% accepted
  • Episodes delivered240
  • Accepted209
  • Camera ↔ joint sync > 5 ms18
  • Dropped frames9
  • Missing operator metadata4

Illustrative example.

Free tool Coming soon

EU Cyber Resilience Act readiness for ROS products

From 11 December 2027, connected products sold in the EU need a software bill of materials (SBOM) and documented vulnerability handling. Generic SBOM tools don't understand ROS workspaces. Ours will.

ROS-aware SBOM generator

Open source. Reads package.xml, resolves rosdep keys to apt/pip packages, and outputs CycloneDX.

Free

CRA Readiness Sprint

A fixed-fee engagement: SBOM, vulnerability baseline, and a vulnerability-handling and 24 h/72 h reporting playbook.

Vulnerability Watch

Monthly monitoring of your SBOM: new CVEs triaged, VEX "not affected" statements, and a reporting log.

Book a readiness call →

We prepare evidence and processes. We don't issue legal opinions or certify CRA compliance.

CRA full application
—days
—hours
—min
11 Sep 2026 Reporting duties apply: 24 h early warning, 72 h notification
How an engagement works

Contract in. Evidence out.

  1. 01

    Define

    We turn your requirements into a machine-checkable contract or SBOM scope, written in plain JSON that you own.

  2. 02

    Pilot

    We run it on a small batch or one product line and tune the thresholds with your engineers.

  3. 03

    Run

    We check every delivery or release with the same open tools, and keep hashes of the inputs.

  4. 04

    Report

    You get decision-ready reports, with evidence your vendors, auditors and customers can verify themselves.

Privacy by architecture

Your recordings never leave your browser.

Robot recordings can contain camera feeds, floor plans and customer sites. So the Tracecheck web app has no server-side processing at all.

  • Static site. HTML, JavaScript and fonts only, all served from this domain. There are no analytics, trackers or third-party scripts.
  • Local worker. Files are read in 8 MiB slices by a Web Worker on your device.
  • Locked-down network. The Content-Security-Policy only allows connections back to this site, which hosts only the demo files.
  • Inspectable. The code is open source under Apache-2.0. You can read it, build it, or run it offline.

Let's take a load off your robot data.

Tell us about your recordings, your data vendors or your EU launch date. You'll get a straight answer about whether we can help.

hello@backplanerobotics.com → Try Tracecheck