SecurityReviewed 23 September 2026 · every claim checked against the code

Evidence that survives the people who hold it. Including us.

Stratl is built on three properties, not on one cloud: a key service that signs but never releases a private key, storage that keeps every version and gives our service no way to delete, and a timestamp from someone who is neither you nor us. Everything on this page follows from those.

Who holds whatand what may cross each line

Your systems

agents, SDKs, capture points
  • Original content
  • Ingest keys (write-only)

Stratl service

API, search index
  • Fingerprints and metadata
  • Chain heads and checkpoints

Your custody

key service and object storage, in your chosen region
  • Signing key, never exportable
  • Signed records, every version
  • Content, if you send it

Outside parties

timestamp authority, any verifier
  • Timestamp tokens
  • The public key and the checks
Your systemsStratl service
  • records, fingerprinted on your side
  • read access for ingest keys
Stratl serviceYour custody
  • sign this
  • write this
  • read this back
  • export the key
  • delete anything
  • change a policy
Your custodyOutside parties
  • one fingerprint of each checkpoint
  • the public key, in every bundle
  • any record, content or identifier
01 · Least power

Our service can do four things to your custody. Here are the five it cannot.

Security starts with what the service is not allowed to do. Its permissions on your key and your storage are written down in an access policy, and this is that policy in plain words.

Granted
  1. Ask the key service to sign

    One request, one signature. The private key never leaves the service that holds it.

  2. Read the public key

    So it can be published and packed into every bundle.

  3. Write records, checkpoints and content

    Under the workspace's own prefix. Writing again keeps the earlier version.

  4. Read them back

    To build the bundles, notices and packs you ask for.

Not granted
  1. Export, copy or wrap the private key

    The permission does not exist, and the key service does not offer it for this key type.

  2. Delete, disable or re-policy a key

    Not granted to the service.

  3. Delete a stored object or version

    Not granted to the service. Storage keeps every version.

  4. Make anything public

    Public access is blocked at the storage level.

  5. Put raw content in the search index

    The index accepts fingerprints and metadata only.

Every use is on the record. The key service logs each signing request in its own audit trail, which we do not control. Each request is also noted by Stratl, with what was signed and the provider's request id, and sealed at every checkpoint into a signed key-usage record in your stream, so the log lives with the evidence and verifies offline.

02 · Nothing readable

A copy of our database gives an attacker nothing to sign in with.

There are no passwords. Every secret that touches Stratl is either stored as a one-way hash or not stored at all.

SecretWhat it isWhat we keepWhat a stolen copy gives
Sign-in codesix digits, ten-minute lifekeyed hash (HMAC) of email and codenothing usable: cannot be reversed or replayed
Sessionone HTTP-only, same-site, secure cookieSHA-256 of the token, plus user agent and IPcannot forge a cookie from the hash
Ingest keyshown once at creationSHA-256 and the last four characterscannot reconstruct a key; a leaked key can only write
Signing keygenerated inside the key servicenothing: only the public key and the key's idno copy exists to steal, here or anywhere
Prompts, outputs, payloadsfingerprinted before they reach usthe fingerprint in the index; originals only if you send them, in your custodythe index reveals no content
03 · No quiet rewrites

Change one record and everything after it says so.

Each record carries the fingerprint of the one before it. Every hour, or every thousand records, a signed checkpoint seals them all and an outside authority stamps the time. Try it.

Six records, one checkpoint, one timestamp
  1. DEC-…48211sha256:e393…prev signed
  2. DEC-…48212sha256:198a…prev e393signed
  3. DEC-…48213sha256:129a…prev 198asigned
  4. DEC-…48214sha256:8ab4…prev 129asigned
  5. DEC-…48215sha256:8385…prev 8ab4signed
  6. DEC-…48216sha256:b4b3…prev 8385signed
CheckpointMerkle root, signed
Timestampoutside authority

Chain intact. Every record's fingerprint is what the next one expects, and the checkpoint covers all six.

04 · Threat coverage

Seven things that could go wrong. Which layer answers each.

Including things that could go wrong with us. Filled dots are the layers that hold when that threat happens. Pick a row to read what happens.

ThreatWorkspace scopingWrite-only keysNon-exportable signing keyVersioned, delete-proof storageHash chain and checkpointsOutside timestampOffline verifier

What happensIts fingerprint and signature no longer match, the next record names the old fingerprint, and the sealed checkpoint still holds the original.

05 · Verify without us

The last check does not need our permission.

Every control above could fail and you would still be able to tell. The verifier runs on your machine, needs no account and makes no network calls. Each check is reported on its own, so a partial failure looks like exactly that.

  • Published standards only

    RFC 8785 canonical JSON, SHA-256, ES256, RFC 7638 key ids, RFC 6962 Merkle trees, RFC 3161 timestamps. Nothing is ours to trust.

  • Three languages, one answer

    Python, TypeScript and Go hash the same fixtures identically, proven on every change.

  • Bundles carry their own proof

    The public key, the checkpoint, its timestamp token and a manifest travel inside the archive. Nothing has to be fetched.

06 · What runs it

Roles the design needs, and who fills them today.

The record format, the verifier and the integrity design are the same whichever provider sits underneath. This is the only place on the page where providers are named.

RoleWhat the design needs from itTodayPlanned
Key serviceHardware-backed keys that can sign but never be exported. Every use logged by the provider.todayAWS KMS, one key per workspace, in the region you choose. Or your own key: AWS KMS, Google Cloud KMS or Azure Key Vault, in your accountplannedMore key services as customers ask
Object storageKeeps every version. No delete permission for the service. Optional retention lock. Public access blocked.todayAmazon S3, one prefix per workspace, in the region you choose. Or your own bucket: S3, Google Cloud Storage or Azure Blob, in your accountplannedMore object stores as customers ask
Timestamp authorityIndependent of you and of us. Standard RFC 3161 tokens that any tool can check.todayTwo RFC 3161 authorities, a public one and a commercial CA's, tried in order; the token names which one answeredplannedMultiple anchors per checkpoint
Search indexFingerprints and metadata only. Never content.todayPostgreSQL, one location for all workspacesplannedPer-region indexes
Application hostTLS everywhere. Secrets by reference, never in code.todayManaged container hosting, with the interface on a static hostplannedSelf-hosted edition

Custody region live today: India (AWS ap-south-1). The search index runs in one location for all workspaces; if its metadata must stay in a particular country for you, Stratl is not ready for that workload yet.

07 · Where we stand

In place, and not yet, on one list.

A security page that only lists strengths is marketing. This list is reviewed on a date and says what is missing, so you can decide what to put on Stratl today.

  • in place
    TLS everywhere

    Between you and the app, the app and the API, the API and every provider.

  • in place
    Encryption at rest

    Server-side encryption on every stored object. Versioning on. Public access blocked.

  • in place
    Signatures verified before write

    Every signature from the key service is checked locally against the public key before anything is stored.

  • in place
    Secrets never in the repository

    Credentials arrive as environment variables or secret references. Production refuses to start with a default secret.

  • in place
    Lint and tests on every change

    Python, TypeScript and Go, plus a conformance check that all three hash records identically.

  • in place
    Content never logged

    Logs carry paths, identifiers and errors. Never prompts, outputs or payloads.

  • not yet
    SOC 2 or ISO 27001 attestation

    Planned. Until then, this page is the control description.

  • not yet
    Independent penetration test

    Before the first enterprise contract.

  • in place
    Dependency and secret scanning in CI

    Every change is scanned for leaked secrets and for known vulnerabilities in Python, JavaScript and Go dependencies. Dependabot opens the upgrade. Coordinated disclosure is described in SECURITY.md in each repository.

  • not yet
    Single sign-on and SCIM

    Not built.

  • in place
    Each key use written as a record

    Every signature request is noted, with what was signed and the provider's request id, and sealed at each checkpoint into a signed key-usage record in your stream. You can verify every use of your key offline and match it to the provider's audit log.

  • in place
    Your own key service and storage

    Take custody from the portal: your bucket and your key on AWS, Google Cloud or Azure. Stratl keeps only the permission to sign and to write, proves it cannot delete before anything moves, and the hand-over is a statement signed by both keys.

Our advice during early access. Start with a staging agent or a low-risk workflow. Export bundles for anything you must keep. The early access page lists everything else that is unfinished.

Report a vulnerability

Found something? Tell us before anyone else.

Write to hello@stratl.ai with "Security report" in the subject. A person reads it. Please do not include customer data, and do not test against workspaces that are not yours.

What we promise

  • A human reply, and a fix or a plan within a stated time.
  • Credit by name if you want it, once the fix is out.
  • No legal action against good-faith research that follows these rules.
  • If your report shows customer data was exposed, every affected workspace is told.

What we ask

  • Test only against your own workspace.
  • Do not read, change or delete data that is not yours, and stop as soon as you can prove the issue.
  • No denial of service, spam or social engineering of our people.
  • Give us reasonable time to fix before you publish.
Questions

What security teams ask.

Does the design depend on one cloud?

No. It depends on three properties: a key service that signs but never releases private keys, object storage that keeps every version and gives our service no delete permission, and a timestamp authority independent of both of us. Today those are provided by AWS KMS, Amazon S3 and a public RFC 3161 authority. The record format, the verifier and the integrity design do not change when the provider does.

Where exactly is my signing key, and who can use it?

Inside the key service, in the custody region you chose, as one key per workspace. It cannot be exported by anyone. The Stratl service holds a permission to sign and to read the public key, and nothing else. The provider logs every use.

Can Stratl read my prompts and outputs?

Only if you send them. The SDK fingerprints content on your side. If you also send the originals so they can be re-hashed later, they go to your custody storage under their fingerprint, never into the search index. Our operators look only when you ask for help.

What if the key service is unavailable?

Nothing is written. Signing happens before a record is chained and stored, and a failed or unverifiable signature stops the write. The SDK spools the record locally and sends it again later.

What if the timestamp authority is down?

The checkpoint is still signed and stored, marked as awaiting a timestamp, and the timestamp is retried on later runs. The verifier reports a missing timestamp as a failed check, not a warning.

Can I delete records?

Not through the service, and neither can we through it. A person at Vyana Compute carries out deletion when you ask, and only for records your workspace's retention policy says are past retention. A legal hold, placed on a decision or on everything about a subject, blocks deletion of what it covers until it is lifted; placing and lifting are themselves signed records in the chain. If the storage has a retention lock, locked versions cannot be removed until the lock expires.

Is there a bug bounty?

Not a paid one yet. We do promise a human reply, credit if you want it, and no legal action against good-faith research that follows the rules on this page.

Private early access · not generally available

Verify it yourself.

Record one decision from a real agent, export the bundle, and run the verifier on a machine with the network unplugged. That is the whole argument.