Security & Data Handling

StratEdge is running an internal SOC 2 and ISO/IEC 27001 readiness program — policies, control mapping, and a gap checklist aligned to the AICPA Trust Services Criteria and ISO 27001 Annex A themes.

We are not SOC 2 certified and not ISO 27001 certified until an independent auditor or certification body issues a report. We will update this page when that changes. Meanwhile we share the controls below so buyers can evaluate current practice.

The application runs on Vercel (serverless, US regions) and stores workflow records in a managed PostgreSQL database provided by Supabase. All traffic between your browser, the application, and these services is encrypted in transit using HTTPS/TLS. Encryption at rest is provided by our infrastructure vendors' managed platforms.

AI features are processed server-side. When you trigger an action (for example, “Generate Summary” or “Flag Risk”), the relevant workflow data is sent from our server to the OpenAI API to produce a response.

• The OpenAI API key is stored as a server-only environment variable and is never exposed to the browser.
• Workflow data is sent to the model only when you explicitly request an analysis, not continuously.
• OpenAI states that data submitted through its API is not used to train its models by default.
• AI output is advisory. We recommend qualified human review before acting on any AI-generated recommendation.

API keys and database credentials are stored as environment variables in the hosting platform and are not committed to source control. Browser-exposed configuration is limited to the public Supabase URL and publishable key, which are designed to be public.

• Privileged cloud and source-control accounts are intended to use multi-factor authentication.
• Application changes are managed through git; production deploys follow the protected mainline release path on our hosting platform.
• Security disclosures and questions: security@stratedgeworkflow.com.

This public tour environment runs on anonymized, illustrative data so anyone can evaluate the platform without exposure to customer records. Customer workspaces are private and separate. Please do not enter real customer personally identifiable information (PII), account numbers, or other sensitive data into the tour environment.

The public tour intentionally omits controls that customer deployments receive, including authenticated user accounts, role-based access, and row-level / tenant database isolation. Customer production posture is designed for stronger isolation; re-enabling and proving those controls is part of our SOC 2 / ISO 27001 readiness roadmap.

• Vercel — application hosting
• Supabase — managed Postgres and related platform services
• OpenAI — model inference when AI features are invoked
• GitHub — source control

A fuller vendor register is maintained internally as part of readiness. Contact us for questionnaire support under NDA.

Security questions or disclosures: security@stratedgeworkflow.com. General: info@stratedgeworkflow.com.