01 · Certifications
ISO 27001 + SOC 2 Type 2: current and externally audited.
ISO 27001 covers the design and operation of our information security management system; the certificate scope covers the full StrataMax platform and the supporting infrastructure, and is renewed annually by a JAS-ANZ accredited external auditor. SOC 2 Type 2 reports on the design and operating effectiveness of our controls over a continuous observation period; the report is available under NDA to qualifying procurement teams. Both are current. Evidence (certificates, scope statements and the latest SOC 2 report) is available on request.
02 · Data residency
Australian data, Australian regions, Australian law.
Customer data is stored in Australian data centre regions and processed under Australian law, with Privacy Act and Australian Privacy Principles obligations applied to the data lifecycle. No customer data is stored in offshore regions by default.
Disclosure: opt-in AI features
AI feature enablement is opt-in. Customers who enable StrataMax AI features may have specific inference requests processed by AI models hosted in our Microsoft Azure infrastructure outside Australia.
03 · Encryption
Encryption at rest and in transit.
Customer data is encrypted at rest using industry-standard symmetric encryption, with keys managed in a key management service. Data in transit is encrypted with TLS 1.2 or higher; older protocols are disabled. Supported cipher suites are documented in the security brief.
04 · Access control
Role-based. Least-privilege. MFA enforced.
Access to customer data is role-based and granted on a least-privilege basis, so staff see only what their role requires. Multi-factor authentication is enforced for all staff and administrative access. Access grants are reviewed on a fixed cycle and revoked on role change or departure, same day.
05 · Audit logs
Every change to customer data, logged and retained.
The platform writes an audit record for every change to customer data: who, what, when, and from where. Logs are tamper-evident, retained in line with trust-accounting audit obligations, and exportable for your external auditor.
06 · Vulnerability management
Pen testing. Patch cadence. Responsible disclosure.
Independent penetration testing is conducted at least annually, and after material changes to the platform. Results are triaged into the engineering backlog and remediated against severity-driven SLAs. A responsible-disclosure channel is published for external researchers.
07 · Incident response
Incident response: documented, tested, and disclosed to customers.
StrataMax maintains a documented incident response plan covering detection, containment, eradication, recovery and post-incident review. Confirmed material incidents carry a defined customer notification commitment. The full IR plan, including the call tree and decision matrix, is available under NDA. Post-incident reports are issued to affected customers.
08 · Employee security
Background-checked staff. Trained continuously. Secure development.
StrataMax employees complete background checks as part of onboarding. Where access is required before checks are complete, production access is restricted according to role and sensitivity until checks are finalised. Security training is delivered at onboarding and refreshed annually, with role-specific training for engineering, support and customer-facing teams. The secure development lifecycle covers code review, dependency scanning, static analysis and a mandatory security review on every change touching customer data.
09 · Business continuity
Backups. Disaster recovery. Tested.
Customer data is backed up on a documented cadence, with backups retained on a published schedule and replicated across Australian regions. The disaster recovery plan defines RTO and RPO targets and is tested at least annually against a documented runbook. Test outcomes and any deviations are reviewed by the leadership team.
