Questions to ask before you rely on it

Use these with any vendor, including us. The answers here are Stratl’s as of the date at the bottom of the page; where the answer is “not yet”, it says so.

Evidence

1. Can someone who does not trust you verify a record? Yes. A free command-line verifier and the same verifier in the browser run twelve checks with no account and no network: the record’s hash, its signature against the public key carried in the bundle, the chain link, the checkpoint signature, the record’s inclusion in the checkpoint, the independent timestamp, and that any original content matches its fingerprint. What each check proves.

2. Is the record format open? Yes. The Stratl Record Format is an Apache-2.0 specification with a JSON Schema and golden fixtures that three independent implementations (Python, TypeScript, Go) must hash identically on every change. The format.

3. Does the record contain our customers’ data? No. Records carry fingerprints of prompts, answers and documents, never the content. Originals can be kept, if you choose, in your custody storage under their fingerprint, outside the search index. What is where.

Control

4. Who holds the signing key, and can it be exported? Either Stratl, as one key per workspace inside a key service, or you, in your own key service. In both cases the private key cannot be exported by anyone, and the Stratl service holds only the permission to sign and to read the public key. Every use of the key is written into your stream as a record. Custody.

5. Can Stratl delete our records? No. The service’s permission on storage is write and read only; storage keeps every version. Deletion is a human act, carried out only for records past your retention policy and not under a legal hold. Retention and holds.

6. Can we take our evidence and leave? Yes, in two ways. Every bundle and pack you have exported verifies without Stratl forever. And a workspace can take custody: its own bucket and key, on AWS, Google Cloud or Azure, with all history copied across and the hand-over signed by both keys. Taking custody.

Operations

7. Where does data live? Records, content, checkpoints and keys: in the custody region the workspace chose, or your own cloud. The search index (fingerprints and metadata, never content) and the API run in one location for all workspaces. Full data residency of the index is not yet offered. The regions.

8. How do people get access, and who can change what? Passwordless sign-in by email code. Four roles: owner, admin, engineer and auditor, enforced on the server for every request. Single sign-on and SCIM are not built yet. Teammates and roles.

9. What happens when a dependency is down? If the key service is down, nothing is written and the SDK spools the record locally for later. If the timestamp authority is down, the checkpoint is still signed and stored, marked as awaiting a timestamp, retried against a second authority and again later. The verifier reports a missing timestamp as a failed check, not a warning. Integrity.

Assurance about Stratl itself

10. Is there an independent attestation? Not yet. No SOC 2 or ISO 27001 report, no independent penetration test. The security page says so, on a date, and lists every control that is in place instead. The claims, cross-linked to the docs and code.

11. What does Stratl do to our evidence, and how would we know? Everything it does is a signed record in your stream: notices approved and sent, holds placed and lifted, the key used, custody moved. Nothing happens to your evidence that you cannot see in your own decision list. Workflow records.

12. What is the commercial model? Private early access, no charge during early access, direct contact with the people building it. See the early-access page, which is kept current by hand and says what works, what is in progress and what is not there.

Answers current as of 23 September 2026.