How We Protect Your Data
Security is not a feature we add — it's how we build. Here's an honest, technical overview of the controls in place and what's on our roadmap.
Security Controls In Production
These protections are live and operating now for every Strata Security customer.
Encryption in Transit
All traffic between your browser and our servers uses TLS 1.2+ (HTTPS). Connections over plain HTTP are rejected at the network edge.
Encryption at Rest
Data stored in Supabase and Upstash Redis is encrypted at rest by the underlying cloud infrastructure. OAuth tokens stored in the database are additionally encrypted using AES-256 Fernet encryption.
Secure Authentication
Authentication is managed by Supabase Auth with bcrypt-hashed passwords. Minimum password requirements (10+ characters, mixed character types) are enforced. Email verification is required before accessing the platform.
Role-Based Access Control
Organizations have owner, admin, and member roles with distinct permission levels. All API endpoints enforce role checks server-side. Role assignments cannot be escalated by non-owners.
Data Isolation (Row-Level Security)
Supabase Row-Level Security (RLS) policies enforce that each organization can only access its own data — scans, findings, files, members, and settings. RLS operates at the database layer, providing defense-in-depth beyond API-level access controls.
Secure File Handling
Uploaded archives are validated before extraction. ZIP bomb protection limits maximum uncompressed size, compression ratio, and entry count. File type and size limits are enforced server-side. Malformed archives are rejected before any processing begins.
File Reputation Checks
Uploaded files are optionally checked against VirusTotal's file reputation database using a cryptographic hash. Only the SHA-256 hash is sent — never the file content itself.
Rate Limiting
API endpoints are rate-limited using Redis-backed sliding window counters. Per-user and per-IP limits protect against credential stuffing, brute force, and denial-of-service attempts.
CORS and CSP
API CORS headers restrict cross-origin requests to trusted frontend origins. Content Security Policy (CSP) headers restrict what resources the frontend can load, mitigating XSS attacks.
Secure OAuth Integration
GitHub and GitLab OAuth flows use HMAC-signed state tokens to prevent CSRF attacks. OAuth access tokens are stored encrypted in the database and are scoped to the minimum permissions required.
Error Monitoring
Application errors are captured via Sentry in real time. This allows us to detect and respond to unexpected failures, including security-relevant errors, before they affect users broadly.
Input Validation
All API inputs are validated using Pydantic schemas. SQL injection is prevented through the SQLAlchemy ORM. SSRF is prevented by validating webhook URLs against an allowlist of safe targets.
Coming Soon
These capabilities are in progress or planned. We believe in being honest about what isn't finished yet.
SOC 2 Type II
We are working toward SOC 2 Type II certification. This involves a formal third-party audit of our security, availability, and confidentiality controls. Target: 2027.
Third-Party Penetration Testing
We plan to engage an independent security firm for periodic penetration testing of the platform and its infrastructure. Results will inform ongoing security improvements.
Bug Bounty Program
We plan to launch a formal bug bounty program with defined scope and rewards. In the meantime, we encourage responsible disclosure via our security email.
SSO / SAML
Enterprise SSO via SAML 2.0 or OIDC to support identity providers like Okta, Azure AD, and Google Workspace is on our roadmap.
Responsible Disclosure
We take all security reports seriously. If you discover a vulnerability in Strata Security, please report it responsibly and give us a chance to fix it before public disclosure.
Disclosure Process
Email your report to security@strata-security.com. We will acknowledge receipt within 2 business days and provide a resolution timeline within 7 days. We aim to resolve critical issues within 30 days.
We appreciate the security research community and commit to: not pursuing legal action against good-faith researchers, publicly crediting reporters who wish to be acknowledged, and promptly fixing valid reports.
Report a Vulnerability →What's in Scope
Our Stack
Full transparency about the providers and technologies underpinning the platform.
Have Security Questions?
Our team is happy to answer technical security questions from customers and prospects.