Signing in and encrypted connections.
Workspace areas require a signed-in user. New accounts verify their email address, and passwords created at sign-up must be at least 12 characters. Pages are served over HTTPS, and the site asks browsers to keep using HTTPS.
Access is limited by role and location.
Role-based permissions and locations decide what each user can see and change. Access rules are enforced in the database as well as in the interface, so hiding a menu item is not the only barrier. Training assignments, quiz attempts, sign-offs and completion records are visible to the employee they belong to and to administrators and managers, not to every user.
Separation between organizations.
Each company has its own workspace, and database access rules are designed to keep one organization’s data from appearing in another’s. The project includes automated database tests that check this separation.
Documents and files.
Documents are stored in private storage rather than on public web addresses. When a file is opened, it is served through a short-lived link.
Credentials and secrets.
Server credentials used to run the service are kept on the server and are not sent to your browser.
Who owns your data.
The documents, records and other content you put into STRATUM belong to your organization. CauseLogic uses that content only to provide the service. Requests to export or delete your organization’s content can be sent through the contact page; specific timelines and formats are being finalized.
What we do not claim.
This page does not claim any third-party security certification or audit, a particular uptime, or specific backup and recovery commitments. If your organization needs those, ask before you rely on STRATUM for them.
Your part.
Choose strong passwords, invite only the people who need access, review roles regularly, and remove access when people leave. Controlling printed copies and documents used outside STRATUM remains your process.
Reporting a security concern.
If you believe you have found a security problem, contact us through the contact page and describe what you saw. Please do not access data that is not yours.