Security

We employ encryption at every layer:

In Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher. We enforce HTTPS on all connections with no fallback to unencrypted protocols.

At Rest: All stored data, including persona research, user accounts, and workshop sessions, is encrypted using AES-256 encryption. Database backups are also encrypted.

Secrets Management: API keys, tokens, and sensitive configuration values are stored in encrypted vaults and never committed to source code.

We implement multiple layers of access control:

Passwords are hashed using industry-standard bcrypt with per-user salts.

Session tokens are securely generated and expire after a configurable period of inactivity.

Role-based access control (RBAC) restricts data access based on user roles (Admin, Team, Client Stakeholder, Viewer).

Team members only see data associated with their assigned clients.

Administrative actions are logged for audit purposes.

Our infrastructure is designed for reliability and security:

The platform is hosted on secure, SOC 2-compliant cloud infrastructure.

Automated deployment pipelines ensure consistent and auditable releases.

System dependencies and packages are regularly scanned for known vulnerabilities.

Infrastructure access is limited to authorized personnel with multi-factor authentication.

Regular backups are performed and tested to ensure data recoverability.

Your data is kept separate and secure:

Each client organization’s data is logically isolated within our database.

Application-level access controls prevent cross-tenant data access.

AI processing requests are scoped to your organization’s data only.

Third-party integrations (Stripe, OpenAI, Resend) receive only the minimum data necessary to perform their function.

We maintain a documented incident response process:

Security incidents are prioritized and investigated by our engineering team.

Affected users will be notified within 72 hours of a confirmed data breach, in accordance with GDPR and applicable regulations.

Post-incident reviews are conducted to identify root causes and implement preventive measures.

Critical security patches are applied promptly upon discovery of vulnerabilities.

We are committed to meeting industry standards:

Our data handling practices are designed to support GDPR and CCPA compliance.

SOC 2 Type II certification is on our compliance roadmap.

We conduct regular internal security reviews and assessments.

Third-party vendors are evaluated for their security posture before integration.

We value the work of security researchers. If you discover a security vulnerability, please report it responsibly:

Email: support@strategical.ai

Please include a detailed description of the vulnerability and steps to reproduce it.

We ask that you give us reasonable time to investigate and address reported issues before public disclosure. We will acknowledge your report within 48 hours and provide updates on our progress.