The controls behind the record.
An audit trail is only as trustworthy as the platform holding it. Here is exactly how that platform is built, operated and tested.
- SOC 2 Type II
- ISO 27001
- ISO 9001
- GDPR
01 — Controls01 / 07
Data protection
- AES-256 encryption at rest, TLS 1.3 in transit
- Per-organization key separation
- Encrypted, tested backups with a 30-day window
- Documented recovery objectives: RPO 1 hour, RTO 4 hours
Access & identity
- SAML 2.0 and OIDC single sign-on
- Organization-wide enforced two-factor
- Least-privilege roles assigned per project
- Session policy and idle timeout per organization
Engineering practice
- Mandatory peer review on every change
- Automated dependency and secret scanning
- Annual third-party penetration test
- Segregated production access with break-glass logging
Monitoring
- Immutable, append-only audit log
- Anomalous access alerting
- 24/7 on-call rotation
- Documented incident response with customer notification SLAs
02 — Independent Assurance02 / 07
Audited by people who are not us.
Certificates and reports are available to customers and prospects — some publicly, some under NDA.
SOC 2 Type II
ISO 27001
ISO 9001
GDPR
ISO 19650
ISO 44001
Full framework detail lives on the compliance page.
03 — Subprocessors03 / 07
Everyone who touches the data.
We notify customers 30 days before adding a subprocessor, and never share document content beyond what a listed purpose requires.
| Provider | Purpose | Region |
|---|---|---|
| Cloud infrastructure | Hosting and storage | EU / US / AP |
| Transactional email | Notifications and invitations | EU |
| Error monitoring | Application diagnostics | EU |
| Support desk | Customer correspondence | EU |
Responsible disclosure
Found something? Email security@strata.example.com. We acknowledge within one business day, will not pursue good-faith research, and credit reporters who want it.