Where StrataLens stands today on security, privacy and certification. We update this page as things change, and we date every claim so you can tell what is held, what is in progress and what is still a plan.
StrataLens Ltd holds Cyber Essentials, Cyber Essentials Plus and IASME Cyber Assurance Level 1 for the whole organisation, all certified in October 2026. Everything else below is in progress or planned, in the order we are working through it. Dates are targets, not promises.
Whole organisation, assessed against the v3.3 requirements by an IASME-licensed certification body (Fig Group). Certificate e2aa59dd-a821-4c8a-930c-a5d0eed077be, renewed annually; next recertification due October 2027.
Independent technical audit of our devices, accounts and cloud services by the certification body's auditor (Fig Group): patching, malware protection, MFA and account separation tested. Certificate 55861a80-4e19-4cb0-a99d-c9f11d4d445d, renewed annually; next recertification due October 2027.
The governance layer above Cyber Essentials: information security policies, risk management, data protection (UK GDPR), supplier management, incident response and business continuity, assessed against the IASME Cyber Assurance Standard v7 (May 2025) by an IASME-licensed certification body (Fig Group). Certificate 1eb4046c-997d-413c-b989-0f08418a5d15, renewed annually; next recertification due October 2027.
Independent test of the platform before the first paid pilot. The scope is written and covers tenant isolation, authentication, outbound connections, untrusted documents and AI prompt injection. Summary and retest results will be shared with customers.
Security and confidentiality criteria, audited by a licensed CPA firm once the production environment is live. Type 2 follows after an observation period.
Certification of our information security management system by a UKAS-accredited body, building on the SOC 2 work.
Not a certificate but a standing obligation. We act as your processor. A data protection impact assessment covering AI use and exchanges between organisations is drafted, and a data processing agreement forms part of our customer terms.
Built to the controls before the audit. The platform is built against SOC 2 and ISO 27001 from the start. Our internal register maps 43 controls to SOC 2 criteria and ISO 27001 Annex A, with evidence for each, and most are already in place. The register is available under NDA.
The facts your risk team usually asks for first. Fuller detail is on the security and data governance page.
Current as of 8 October 2026. We tell customers before adding or changing a sub-processor.
| Provider | Purpose | Location |
|---|---|---|
| Microsoft (Azure) | Hosting, database, key management, logging, AI (Azure OpenAI), email notifications | United Kingdom (Azure UK South; email via Azure Communication Services with UK data location) |
| Microsoft (Entra ID) | Sign-in and identity. Holds user identifiers only | Global service |
Our source code is hosted on GitHub. No customer data is stored there. Nothing is processed by any other provider.
Platform controls only matter if the company behind them is run carefully too.
Company devices are centrally managed with enforced disk encryption, malware protection, firewall and automatic updates installed within days. Multi-factor authentication is on for every cloud service we use. Administrative work uses separate accounts.
Every change goes through a pull request on a protected branch with signed commits. Automated checks for secrets, infrastructure misconfiguration, code vulnerabilities, dependencies and container images must pass before anything is merged. Dependencies are updated automatically.
All cloud infrastructure is defined as code and applied only from the main branch. Services authenticate to each other with managed identities rather than stored secrets. Data services have no public endpoints, and deployment identities cannot grant themselves privileged roles.
Most of this is available under NDA as part of a due diligence pack. We will also complete your own third-party risk questionnaire.
If your assessment process needs a current certification as a gate, tell us early and we will be straight with you about timing.
Request the due diligence packIf you believe you have found a vulnerability in StrataLens, email info@stratalens.co.uk with "Security vulnerability report" in the subject. Tell us what you found and how to reproduce it. We acknowledge reports within two working days and keep you informed until the issue is resolved.
Please test only against accounts and data you own or we have provided for the purpose, do not access or alter other organisations' data, and give us reasonable time to fix the issue before any public disclosure. We will not take legal action against research conducted in good faith within these limits.
Tell us what your assessment needs and we will add it or answer it directly.
