Security claims, cross-linked

stratl.ai/security lists what is in place and what is not, reviewed on a date. This page is its backing: for each row, where in these docs it is explained and where in the code it is enforced. Code paths are in the backend repository unless stated.

in placeTLS everywhere

Between the browser and the app, the app and the API, and the API and every provider. The API is served only behind the host’s TLS; the portal forwards /api server-side so the session cookie stays first-party.

Read the documentation →Code deploy/, vercel.json

in placeEncryption at rest

Server-side encryption on every stored object, versioning on, public access blocked, in the managed bucket templates and required of customer buckets by the take-custody probe.

Read the documentation →Code deploy/cloudformation/managed-custody.yaml

in placeSignatures verified before write

Every signer class checks the signature it receives from the key service against the public key before anything is written. A misconfigured key cannot produce a bad record silently.

Read the documentation →Code api/app/custody/keys.py

in placeSecrets never in the repository

Credentials arrive as environment variables or secret references. Production refuses to start with the default secret key. Every commit is scanned for leaked secrets in CI.

Read the documentation →Code api/.env.example, .gitleaks.toml

in placeLint and tests on every change

Python, TypeScript and Go, plus the conformance check that all three hash the golden fixtures identically.

Read the documentation →Code .github/workflows/ci.yml

in placeContent never logged

Logs carry paths, identifiers and errors. Prompts, outputs and payloads exist only as fingerprints in the index and, if uploaded, as bytes in custody storage.

Read the documentation →Code api/app/logging.py

in placeDependency and secret scanning in CI

gitleaks over the history, pip-audit, pnpm audit and govulncheck on every change; a high finding fails the build. Dependabot opens upgrades weekly. A SECURITY.md in each repository says how to report a vulnerability.

Read the documentation →Code .github/workflows/ci.yml, .github/dependabot.yml

in placeEach key use written as a record

Every signature request is noted with what was signed and the provider’s request id, and sealed at each checkpoint into a signed DEC-KEY-… record in the workspace stream.

Read the documentation →Code api/app/custody/keyledger.py

in placeYour own key service and storage

Take custody from the portal on AWS, Google Cloud or Azure. Stratl proves it can sign, write and not delete before anything moves; the hand-over is signed by both keys.

Read the documentation →Code api/app/custody/providers.py, api/app/custody/transfer.py

not yetSOC 2 or ISO 27001 attestation

Planned. Until then, the security page and this page are the control description. Say so when asked.

not yetIndependent penetration test

Before the first enterprise contract.

not yetSingle sign-on and SCIM

Sign-in is by email and one-time code; roles are enforced on the server. Directory integration is not built.

Read the documentation →

If a row on the security page has no entry here, or an entry here disagrees with the page, that is a bug in the docs. How to fix it.