Security & data governance

Written for the people who assess us: third-party risk, information security and operational resilience teams at carriers, managing agents and brokers.

Principles

Four things we designed around

Provenance, not just output

Every value StrataLens produces carries a reference back to the source document and field it came from. When an output has to be explained — to a regulator, in a coverage dispute, or to your own audit function — the chain is there rather than reconstructed afterwards.

Your systems stay yours

We sit alongside your estate rather than replacing it. There is no migration, no cutover, and no dependency created that you cannot exit from. Turning StrataLens off leaves your core systems exactly as they were.

Human in the loop by default

Ambiguous mappings are surfaced for a person to confirm, not silently resolved. The system handles transcription and structuring; your experts keep the underwriting and claims decisions.

Least data, least privilege

We take the narrowest scope that makes the integration work, and no more. Access is role-based and scoped per deployment, and we can work against redacted or synthetic data during evaluation.

Controls

What we can evidence today

We would rather tell you plainly where we are than imply a maturity we have not reached. Detail on each of the following is available under NDA as part of a due diligence pack.

Data handling

UK and EEA data residency options, confirmed per deployment before any data is ingested.
Encryption in transit and at rest.
Documented retention and deletion periods, agreed per client rather than set by us unilaterally.
Field-level lineage from every output back to its source record.

Access & identity

Authentication through your existing Microsoft 365 identity provider — no separate credential store for your users.
Role-based access control, scoped per deployment.
Audit logging of access and of data transformations.

AI and model governance

Documented record of which models are used where, and for what.
Client data is not used to train third-party foundation models.
Human review points at every step where the system infers rather than reads.
Outputs are traceable, so an AI-assisted result can be checked rather than taken on trust.

Supplier and resilience

Sub-processor register, disclosed in full during due diligence.
Documented business continuity and incident response procedures.
Exit plan and data return process defined before contract, not after.

Certification roadmap. We hold Cyber Essentials, Cyber Essentials Plus and IASME Cyber Assurance Level 1 (all certified October 2026). SOC 2 is on our near-term roadmap and we are building against its control set now. We do not hold it yet, and we will not claim otherwise on a website. If your assessment process requires a current certification as a gate, tell us early and we will be straight with you about timing. Current status of each certification, with dates, is on our trust centre page.

Working with us

Starting your assessment

We know the outsourcing and operational resilience assessment is where a pilot either starts or stalls. We would rather begin it on day one than discover your questionnaire in week six.

Send us your third-party risk pack whenever you are ready and we will complete it. If it would be quicker, we can walk your risk team through the architecture first so the questions come back sharper.

Request our due diligence pack

Available under NDA

Architecture and data flow diagrams
Sub-processor register
Information security policy set
Business continuity and incident response plans
Exit plan and data return process
Model and AI governance documentation

Questions your risk team needs answered?

Send them over. We would rather deal with the hard ones early.

Email us 020 3432 3362