Protect the deals, documents, and relationships that make your firm.

StratiqAI runs on established cloud infrastructure providers, each independently audited.

• Providers secure physical data centers, hardware, the hypervisor, and the underlying network.
• StratiqAI secures customer isolation, identity and access, encryption and key management, the agents and their permissions, application security, change management, monitoring, and backups.
• Your organization decides who has access and in what role, which outside systems you connect, which agents may write to them, and how your people review agent output.

• Dedicated microVM.

  Each environment is its own lightweight virtual machine with its own kernel, behind hardware virtualization. That's a stronger boundary than the shared-kernel containers many multi-tenant services use. No other customer's workload runs inside it.

• Dedicated encrypted volume.

  Conversations, files, agent memory, and connected credentials live on a block volume attached only to your virtual machine, encrypted at rest by the infrastructure provider.

• Private network per customer.

  Each environment has its own private IPv6 network (6PN) for its entire life. Networks for different customers have no route and no private DNS between them, so one customer's environment cannot even discover another's.

• Minimal public surface.

  The agent runtime and its management dashboard listen only on the local machine and are not published to the internet or to any private network. Your web application is the only service your environment exposes. It accepts HTTPS and redirects HTTP to HTTPS. Internal maintenance endpoints are never exposed on the public edge, and a private health-check path exposes only health and readiness status.

• Suspend when idle.

  Unused environments suspend to zero compute. Nothing runs until a request wakes them.

Your environment talks to the control plane over a single outbound HTTPS channel, authenticated with a rotatable credential unique to your environment and accepted for your organization only. Only an explicit allowlist of operations is accepted. No customer environment holds the central database credentials, the infrastructure management token, the payment processor secret, or the platform key vault's master keys. Even a fully compromised environment would hold nothing that can read another customer's data.

• Sign-in: Email and password, or a supported single sign-on provider such as Google, handled centrally by the control plane.
• Sessions: Cookies are HttpOnly, Secure, and SameSite=Lax. Sessions last at most 8 hours, and account sessions end after 1 hour of inactivity.
• Signed handoff: Opening your workspace uses an Ed25519-signed token (RFC 8032). It names the person, their role, and the one environment it's for. It expires within 60 seconds, can be used once (replays are refused), and is rejected by any other environment. The exchange endpoint is rate-limited.
• Live permission checks: Every administrative request is re-checked against current membership. When you remove a team member, their access to administrative operations ends on their next request.
• Step-up for sensitive actions: Destroying a workspace, rotating credentials, and replacing or disconnecting a connected system's key all require a sign-in from the last 10 minutes.
• Team roles: Owner, admin, and member.
• StratiqAI operator access: Limited to a named allowlist of staff accounts that sign in through single sign-on. Every operator change requires a written reason and is recorded in the audit log. Destructive operations also require typing the workspace name. Infrastructure credentials are scoped to a single environment.

• In transit: TLS for all browser traffic, plus HSTS for one year including subdomains. HTTPS between your environment and the control plane, and to outside services. Traffic between your web app and agents never leaves the local machine.
• At rest: Customer volumes, object storage (attachments and backup archives), and the control-plane database are encrypted at rest.
• Application-layer envelope encryption: Connected-system credentials (OAuth tokens, API keys) are each encrypted with their own random 256-bit data key using AES-256-GCM (NIST SP 800-38D). That data key is wrapped with a key-encryption key. Each secret is bound to its owner (your organization and the kind of secret), so a copied secret won't decrypt elsewhere.
• A key that belongs only to your environment: Each environment has its own independently generated key-encryption key. It is installed only in that environment and never stored in the control-plane database. The control plane's vault keys are never present in customer environments.
• Rotation: Key-encryption keys are versioned. When a new version is installed, your environment re-encrypts every stored secret under it at startup. The previous version is retired only after an operator confirms nothing still uses it.
• Escrow and recovery: Each environment key is sealed to an offline recovery key (X25519, RFC 7748; HKDF-SHA256; AES-256-GCM). Only the sealed copy is kept centrally. Environments pin the recovery key's fingerprint and refuse to seal to any other.

• OAuth: Sign-in starts and finishes at the control plane. Your environment collects the encrypted bundle over its authenticated channel and stores it in its own vault, and then the control plane deletes its temporary copy. Tokens refresh on demand and are stored locally.
• API keys: Go straight to your environment, are verified with the vendor, and are stored only in your environment's encrypted vault. They are never returned to the browser, written to logs, or sent to the control plane.
• Read-only by default: Connections start read-only. Write access must be turned on per connection and then granted per agent. The Microsoft 365 connector requests read-only permissions to mail, calendar, and files.
• SSRF protection: HTTPS only, per-connector host allowlist, no redirects, private/loopback/link-local/internal destinations refused, and capped response sizes.

• Approval before action: By default, agents need a person's approval before running a command flagged as risky. Admins can choose a less strict mode, but deny rules always apply.
• Hard deny rules: These operations are always refused: accessing credential files, editing the agent's own configuration, touching the workspace database directly, piping downloaded content into a shell, and wiping the data volume.
• Guarded memory and skills: When enabled, changes an agent makes to its long-term memory or skills require approval.
• Separate agents, separate keys: Each hired agent has its own profile, memory, and access keys. Roles you haven't hired aren't installed.
• Spending controls: Each customer has its own AI model gateway key, capped by your prepaid AI balance. When the balance runs out, new AI work pauses. Your environment can read its credit status but can't change balances.
• Bring your own model keys: Organizations with their own model provider agreements can supply their own keys.
• No cross-customer context: Agents see only your environment's data.

Defenses are aligned with the OWASP Top 10 and ASVS:

• Content Security Policy (first-party only by default).
• Clickjacking protection (frame-ancestors 'none', X-Frame-Options: DENY).
• Browser isolation headers (nosniff, COOP/CORP same-origin, strict Referrer-Policy, Permissions-Policy disabling camera, microphone, and geolocation).
• CSRF origin checks.
• Rate limiting on handoff, chat, attachments, connections, and agent tool endpoints.
• Secret redaction in logs.
• Attachment upload links that expire after 15 minutes by default, with downloads access-checked by the app.
• Signed payment webhooks.
• No card data on StratiqAI systems.
• Row-level security on control-plane tables.
• The web app runs as an unprivileged OS user.

• Separate environments: Development, staging, demo, and production run in separate cloud accounts, each with its own database, keys, tokens, and payment config. Nothing is shared between them.
• Tracked and reviewed changes: Every change ties to a tracked work item and lands via a pull request with human merge approval. Changes are tested in development and staging before production.
• Immutable, pinned images: Runtime images are referenced by cryptographic digest, and non-pinned references are refused. Each image is built once and promoted unchanged. Dependencies are pinned, with automated update PRs. Agent role definitions are read-only at runtime.
• Careful rollouts: Updates go to a canary environment first. If readiness checks fail, the platform tries an automatic rollback, which never deletes volumes or environments.

• Volume snapshots: Kept 60 days, plus a snapshot before every configuration change, agent hire or removal, and software rollout.
• Off-platform archives: Weekly full and daily quick archives go to separate encrypted object storage, so they survive even if the compute platform is unavailable.
• Control-plane database: Automatic provider backups, plus a manual backup before each schema migration.
• Tested restores: A restore builds a new volume and keeps the old one, so it is reversible. It also rotates agent access keys. The full destroy-and-restore sequence is rehearsed in staging.
• Continuous monitoring: Health and readiness checks run on every environment. A reconciler compares intended and actual fleet state every 15 minutes and reports drift (it never deletes on its own). Critical findings and failed jobs, rollouts, and restores alert the operations team.

• You own your data. Your organization keeps ownership of everything you provide. We process it only to operate your agents.
• Retention: Chat messages and agent tool activity are kept 90 days on base plans and 365 days on higher plans, then deleted automatically.
• Disconnect and removal: Disconnecting a system deletes its stored credentials. Removing an agent deletes its profile and keys.
• Cancellation: There is a 7-day grace period, after which the environment, including its virtual machine and volume, is deprovisioned.
• Data residency: Customer environments and the control-plane database run in United States regions by default.