Stravito

Stravito hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Security isn't a single yes/no, but Stravito is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Stravito hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@stravito.com or via a /security page (Stravito lists a security contact).

Stravito lists 13 subprocessors on its trust center, including Amazon Web Services , Datadog, Intercom, Google Workspace, ClickHouse. Buyers use this for fourth-party risk review.

Stravito hosts on AWS, GCP, Azure, and handles Customer personally identifiable information, Employee personally identifiable information. Data residency details are on its trust center.

Stravito's trust center is at https://trust.stravito.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

##### Why is trust crucial for Stravito's services? Trust forms the cornerstone of our relationship with customers, especially as they entrust us with their critical knowledge and market intelligence. We recognize that trust is not given lightly; it is earned over time through consistent actions and decisions. To foster this trust, we have instituted a comprehensive trust framework, demonstrating our commitment not only to enhancing our internal operations but also to ensuring the utmost safety of our customer's data. ##### What is the Stravito Trust Framework? The Stravito Trust Framework is our foundational structure to build and maintain trust with our clients. It is composed of five key pillars: !Stravito Trust framework 1. Privacy: Ensuring the confidentiality and proper handling of customer data. 2. Corporate Social Responsibility (CSR): Committing to ethical business practices, community engagement, and environmental stewardship. 3. Compliance: Adhering to industry standards and legal requirements to safeguard data integrity and privacy. 4. Security: Implementing robust measures to protect against unauthorized access, data breaches, and other cyber threats. 5. Risk Management: Proactively identifying, assessing, and mitigating potential risks to data and operations. We believe these areas are deeply interconnected. Excelling in one requires a comprehensive, holistic approach that considers the interplay of all five pillars. ##### How can I get more information or provide feedback? Your questions and feedback are invaluable to us. Please feel free to reach out at any time via [trust@stravito.com](mailto:trust@stravito.com). We are here to listen and continually improve upon the trust you place in us.

##### What certifications does Stravito hold for information security? Stravito's SaaS development and delivery are ISO/IEC 27001 certified. This certification demonstrates our commitment to a robust information security management system (ISMS), ensuring the protection of sensitive data through a comprehensive risk management process. This process encompasses IT systems, personnel, contractors and service providers, and operational procedures. ##### Is Stravito SOC 2 compliant? Yes! We're SOC 2 type 2 attested to all Trust Service Criteria and you can find our full SOC 2 report here. ##### How does Stravito comply with GDPR? Stravito adheres strictly to the General Data Protection Regulation (GDPR) to safeguard the personal data of EU citizens. GDPR aims to give individuals more control over their personal information. For detailed information about our GDPR compliance measures, please feel free to contact us. ##### How does Stravito address the ePrivacy directive? In line with the ePrivacy directive, primarily concerned with cookie use, Stravito ensures that only essential cookies are set after obtaining user consent and post-login to the Stravito SaaS. We respect your privacy by not setting any tracking cookies. ##### Does Stravito comply with other international privacy regulations? Stravito is committed to aligning with international privacy laws, including the California Consumer Privacy Act (CCPA) in the US, the Personal Information Protection and Electronics Documents Act (PIPEDA) in Canada, the Personal Data Protection Bill (PDPB) in India, and the Privacy Act in Australia. ##### How does Stravito manage customer-specific compliance requirements? We maintain rigorous processes to continuously review and meet our customers' specific needs regarding legal, privacy, information security, and ethical and social responsibilities. This proactive approach ensures ongoing compliance and alignment with our customers' expectations and requirements.

##### How does Stravito manage risks? At Stravito, risk management is a continuous and proactive process. We systematically assess potential risks affecting our technical solutions, processes, policies, and organizational structure. Our approach considers both internal operations and external factors, ensuring a comprehensive evaluation to maintain the highest standards of service and security. ##### What happens if the safeguards at Stravito fail? While we take extensive measures to mitigate risks, we understand the importance of being prepared for unforeseen circumstances. In the unlikely event that our safeguards are compromised, Stravito is backed by a robust insurance policy. ##### What kind of insurance coverage does Stravito have? Stravito partners with an internationally recognized insurance provider, boasting an A+ rating from Standard & Poor’s for financial strength. Our insurance coverage is meticulously tailored to the specific nature of our services, as well as the legal requirements and social frameworks of the countries where we operate. This ensures that we are well-prepared to handle a wide array of scenarios, aligning with the common insurance needs relevant to our service offerings and operational regions.

##### How does Stravito integrate CSR into its operations? Stravito is deeply committed to CSR, focusing on our employees, customers, the environment, the community, and our suppliers. We ensure that our business operations and partnerships reflect our dedication to ethical practices, sustainability, and social responsibility. ##### What is Stravito's approach to employee wellbeing and diversity? At Stravito, we value diversity as a cornerstone of our success. We are dedicated to maintaining a safe, healthy, and fair working environment for all our employees. This includes a zero-tolerance policy towards child and forced labor, applicable to both our operations and those of our partners. ##### How does Stravito maintain a transparent relationship with its customers? Our goal is to make interactions with Stravito straightforward and uncomplicated. We engage in open, transparent dialogues with our customers, ensuring our business practices are fair and competitive. Feedback and interviews with customers are integral to our continuous product and company development. ##### What measures does Stravito take to protect the environment? Stravito is actively working to minimize our environmental impact. We enforce internal policies for waste management and strive to reduce pollution and energy consumption. Our Stravito SaaS platform aids companies in innovating for sustainability, such as adopting greener products, minimizing waste, and meeting evolving market demands. Additionally, our digital platform promotes knowledge sharing, reducing the need for physical meetings. ##### How does Stravito engage with the community? Engaging with our local and international communities is a priority for Stravito. We primarily contribute by offering internships and supporting master's thesis projects for students from both local and international universities. ##### What are Stravito's expectations from its suppliers? We expect our suppliers to mirror our CSR commitments. This means…

##### How does Stravito ensure the security of its cloud services? Stravito prioritizes the security of our cloud services, as evidenced by our ISO 27001 certification. We operate a dedicated Information Security Management System (ISMS), overseen by security experts committed to enhancing our organization's security posture. ##### Who is responsible for the security of Stravito's services? Our DevSecOps teams, trained in secure development and incident response, are responsible for the security of our services. They are available 24/7 to promptly address any bugs, incidents, or vulnerabilities that may arise. #### Infrastructure ##### How is Stravito's cloud infrastructure managed? Stravito's services are entirely cloud-based, utilizing Amazon Web Services for its robust security measures and compliance certifications. Our infrastructure operates in AWS data centers in the EU and the United States to optimize service responsiveness for our customers. Detailed information about AWS Cloud Security practices can be found here. ##### What measures are in place for network security? Our network security architecture includes multiple security zones, a Virtual Private Cloud (VPC) with network access controls, IP address filtering, load balancers, firewalls, and DDoS protection services to prevent unauthorized access and ensure network integrity. ##### How is data encrypted and managed? Stravito ensures data encryption both in transit (using TLS 1.2 or higher) and at rest (with AES-256 encryption algorithms). Customer data is securely retained while you are a client and is transferred back and then securely deleted from the Stravito Cloud upon service termination. User activity logs are retained for 30 days before complete removal. ##### How does Stravito handle business continuity and disaster recovery? We aim for the highest service availability, with critical assets running in high-availability configurations or replicated in near real-time. Regular backup restoration…

##### How does Stravito ensure privacy in its services? Privacy is a priority for Stravito. We adhere to best practices like privacy by default and privacy by design to safeguard the confidentiality and integrity of all personal data we handle. These principles guide the architecture of our services and the processing of personal data, ensuring robust protection and respect for user privacy. ##### What personal data does Stravito collect and why? To deliver our services effectively, we collect certain information from users, typically employees of our customers, who access the Stravito SaaS. The data collected includes: - Name - Corporate email address - Role and organizational unit (if provided by the customer) - IP address We use this data for: - User identification and authorization - Audit logging and security monitoring of the Stravito SaaS - Enhancing and personalizing our services ##### Who processes the personal data collected by Stravito? See the subprocessor tab for a full list of our subprocessors. ###### Updates to subprocessors You can subscribe to updates to our list of subprocessors right here in the Trust Center. - In the top right-hand corner of the Trust Center, click "Subscribe to updates" - You can subscribe to various updates, make sure to include "Subprocessor updates" for notifications about changes to subprocessors. ##### What is Stravito's policy on data retention? User accounts in the Stravito SaaS are kept indefinitely while active. Upon manual deletion of a user account or a customer's request, we remove the associated user data. Users can also personally request the deletion of their usage data by contacting our Privacy team at [privacy@stravito.com](mailto:privacy@stravito.com). ##### What are my rights regarding my personal data at Stravito? As a data subject, you hold several rights: - Access: You can request access to your personal data processed by us. - Rectification: You have the right to correct inaccurate or incomplete personal…

##### Updates to subprocessors You can subscribe to updates to our list of subprocessors right here in the Trust Center. - In the top right-hand corner of the Trust Center, click "Subscribe to updates" - You can subscribe to various updates, make sure to include "Subprocessor updates" for notifications about changes to subprocessors.

##### No, we don't. Stravito utilize third-party LLMs to provide its GenAI features. We have contracts in place with out providers ensuring that they do not train models on customers data, inputs or outputs.

You can report a security issue using our vulnerability disclosure program, run in partnership with HackerOne.

At Stravito, we are deeply committed to fostering a culture of transparency, integrity, and accountability. We recognize our duty of care to employees, customers, and stakeholders and take this responsibility seriously. If you observe behavior or practices that you believe violate our values, commitments, or applicable laws and regulations, we encourage you to speak up. We assure full protection for whistleblowers and respect their choice to remain anonymous. You can report your concerns confidentially at any time by using this form or email us at speakup@stravito.com. For enhanced anonymity when reporting - Use our form in private browsing / incognito mode - Consider using a dedicated anonymous email service rather than a work or personal email - If using company equipment, be aware that activity may be monitored - For maximum anonymity, consider using a personal device on a non-work network We are committed to investigating all reports thoroughly, regardless of how they are submitted.