Security at StriideAi

StriideAi uses layered controls across infrastructure, applications, access, monitoring and operational processes.

3.1 Infrastructure

Core production services are hosted on Amazon Web Services in:

London, United Kingdom — AWS eu-west-2

This includes the primary:

• application environment;
• database;
• file storage;
• caching;
• backups;
• snapshots.

Production and staging environments are separated.

3.2 Encryption

StriideAi uses:

• HTTPS/TLS encryption in transit;
• encryption at rest across core production data stores;
• encrypted backups and snapshots;
• secure mobile-device storage for supported credentials.

3.3 Access controls

Privileged access is protected through:

• named user accounts;
• MFA;
• role-based access;
• least-privilege permissions;
• restricted production access;
• periodic access reviews.

3.4 Secrets and credentials

Sensitive production secrets are held server-side and are not embedded in the mobile application.

Secret access is restricted to authorised systems and personnel.

3.5 Monitoring

StriideAi uses security and application monitoring for:

• errors;
• service availability;
• application failures;
• suspicious activity;
• operational incidents.

Technical monitoring is configured to reduce unnecessary capture of personal information.

3.6 Vulnerability management

StriideAi maintains:

• dependency/security scanning;
• secure code review;
• vulnerability tracking;
• remediation of material findings;
• periodic independent security testing.

3.7 Backups and resilience

StriideAi maintains:

• scheduled backups;
• encrypted snapshots;
• defined retention;
• restore testing;
• recovery procedures.

3.8 Incident response

StriideAi maintains a formal security-incident and personal-data-breach process covering:

1. detection;
2. escalation;
3. severity assessment;
4. containment;
5. investigation;
6. evidence preservation;
7. recovery;
8. notification assessment;
9. remediation;
10. post-incident review.

Where legally or contractually required, StriideAi will notify the relevant organisation, regulator and/or affected individual.

Security/privacy concerns can be reported to:

privacy@striide.app

---