Safe, secure, and confidential
STRAND is built to keep your infrastructure data secure, protected, and under your control.
Compliance
STRAND meets the security and compliance standards your organization requires, verified by independent auditors.
SOC 2 Type II
Annual SOC 2 Type II audit covering security, availability, and confidentiality. Reports available on request.
GDPR
Fully compliant with GDPR. Data processing agreements available for EU customers.
ISO 27001
Certified under ISO/IEC 27001:2022. Available to Enterprise customers on request.
Data Protection
Your data is encrypted at rest and in transit. We don't share, sell, or train on it.
Encryption at rest
All stored data is encrypted with AES-256. Keys are managed per-tenant and rotated on a regular schedule.
Encryption in transit
All connections are forced over HTTPS with TLS 1.2 minimum. Unencrypted connections are rejected at the network edge.
Data retention
Retention windows are configurable per plan. Data is permanently deleted within 30 days of account termination.
Backups
Continuous backups with point-in-time recovery, stored in a separate region from primary data.
Access Control
Granular access controls that integrate with your existing identity infrastructure.
Single sign-on
Google SSO on all plans. SAML SSO on Enterprise, supporting Okta, OneLogin, Auth0, and most major identity providers.
SCIM provisioning
Provision and deprovision users automatically through your identity provider. Seat changes sync in real time.
IP restrictions
Restrict workspace access to an allowlist of IP addresses or CIDR ranges.
Audit logs
Every user action is logged with a full audit trail, exportable and retained for 12 months on Enterprise.
Infrastructure
STRAND runs on AWS across multiple availability zones, held to the same security standards we hold ourselves.
Multi-region hosting
US hosting by default. EU hosting available for Enterprise customers with data residency requirements.
99.9% uptime SLA
Guaranteed on all paid plans. Enterprise includes a contractual SLA with defined remedies for any breach.
Penetration testing
Annual third-party pen testing with findings remediated on a defined schedule. Results available to Enterprise under NDA.
Vendor security
All vendors with access to customer data are reviewed before onboarding and audited annually.