Security and data protection
Stratus is built for insurers and their supply chains. Client data is protected by design, and our controls are certified, tested and reviewed on a fixed schedule.
Certification and assurance
- Certified under the UK government's Cyber Essentials scheme, assessed by an IASME-licensed body.
- A documented information security policy set, approved by our board and reviewed every year.
- Regular security testing of the platform under our Security Testing Policy, following OWASP methods.
- Continuous external monitoring of our domains and services.
Where client data is held
Client data is stored in the European Union (Netherlands) and the application runs in the United Kingdom (London). Only user sign-in details are held in the United States, under the UK-US Data Bridge. Client data is encrypted at rest and in transit (TLS 1.2 or higher on every connection).
How the platform protects data
- Each client's data is isolated, and every request is checked against the client it belongs to.
- Role-based access control, with least privilege for every user and administrator.
- An audit log of user, data and administrative actions.
- Every change is tested automatically and reviewed for security before release.
Our use of AI
AI helps users read contracts and explore their own data. Figures come from the client's data, not from the model. No personal data is sent to our AI provider, client data is never used to train AI models, and a person confirms AI suggestions before they are used.
Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Application hosting | United Kingdom (London region) |
| Railway Corporation | Database and backups | European Union (Netherlands) |
| Clerk Inc. | User sign-in | United States (UK-US Data Bridge) |
| OpenAI | AI processing of business data. No personal data is sent | United States (Standard Contractual Clauses) |
| Microsoft | Email and documents | United Kingdom and European Union |
Every sub-processor is bound by a data processing agreement. We give clients 30 days' notice of any change to this list.
Reporting a security issue
If you believe you have found a security issue in Stratus, email security@stratussolutions.co.uk. We acknowledge reports within two working days and keep you updated until the issue is resolved. Please give us reasonable time to act before sharing details publicly, and do not access or change data that is not yours. We will not take action against anyone who reports an issue in good faith under these terms.
Contact
Security: security@stratussolutions.co.uk
Data protection: privacy@stratussolutions.co.uk