Data Processing & Security Overview

1. Scope and contractual boundary

This overview explains STRACT, Inc.’s approach across Pulse, Signal and related Services. It does not replace a negotiated Data Processing Addendum, Security Exhibit, SLA, subprocessor list or deployment-specific agreement.

Actual obligations and enabled controls depend on the applicable service and signed terms. Private or white-label branding does not by itself establish separate infrastructure, identity, storage, providers or support access.

2. Governance, ownership and purpose limitation

Customers retain rights in their Customer Data, subject to individual and third-party rights. Processing should be limited to authorized service purposes and lawful documented instructions.

Data minimization means collecting and sharing information appropriate to the enabled workflow. Avoid unnecessary sensitive information in free-text fields, prompts, attachments and support requests.

3. Authentication, roles and organization segregation

Pulse uses authentication and role-, membership- and assignment-based authorization to limit access to appropriate organization and workspace scopes. Selecting an organization or holding an administrative title is not an unrestricted grant to operational data.

Access should be reviewed when roles, membership or engagements change. Supplier, customer, staff and candidate workflows have different permissions. Organizations must authorize users appropriately and communicate required access changes.

4. Personnel access

Access for operational or support personnel should be limited to authorized work and appropriate scope. Request the applicable personnel-access and support arrangements during diligence rather than assuming all staff can see all customer information.

5. Transport, storage and encryption

Confirm transport protection, storage-encryption coverage and key-management arrangements for the applicable deployment through STRACT’s security diligence process. This overview does not assert an unverified encryption standard, key-ownership model or end-to-end encryption guarantee.

Do not transmit credentials or unnecessary confidential records through ordinary inquiry channels. Use an agreed secure exchange for sensitive diligence or incident materials.

6. Logging and auditability

The Platform records relevant activity and decisions in supported workflows to assist accountability and review. The events available, access to audit records and retention depend on the workflow and applicable arrangements.

This overview does not promise that every event is captured or that all logs have identical retention, immutability or export properties. Audit records may remain subject to legal and security retention requirements after other records are removed.

7. Development, changes and vulnerabilities

Development and changes should be reviewed against authorization, data-handling and service-integrity requirements. Relevant testing and vulnerability findings inform remediation and release decisions.

Request verified testing scope, current remediation information and applicable change-management commitments during diligence. Do not interpret this overview as a certification, independent audit or guarantee of continuous testing or vulnerability-free operation.

8. Incident response and notification

Suspected security incidents should be reported to privacy@stract.us or the STRACT contact form with a description, affected service and safe contact details. Do not include passwords, private keys or unrelated personal information.

Investigation, containment, communication and any customer or regulatory notification must follow applicable law and signed commitments. This public overview does not establish an unverified incident-response deadline or replace a negotiated notification obligation.

9. Backup, continuity and recovery

Backup coverage, retention, restoration procedures, continuity arrangements and any recovery or availability targets require confirmation for the applicable deployment. Recovery testing and any contracted guarantees must be documented separately.

This overview does not guarantee a particular backup frequency, recovery-point objective, recovery-time objective or uninterrupted service.

10. Providers, subprocessors and transfers

Services may involve providers for hosting, storage, authentication, communications, payments, analytics, security and AI. Request a current, approved provider and subprocessor list, relevant processing locations and required international-transfer arrangements for the applicable deployment.

No verified complete subprocessor inventory, certification or residency commitment is established by this overview. DPA requirements and provider-change notifications are governed by applicable agreements and law.

11. AI and Signal data handling

Authorized intelligence workflows may send permitted records or selected context to an approved model provider to produce assistive outputs. Users must review evidence and retain responsibility for consequential decisions.

Provider inventory, prompts and data sent, retention, training settings and customer controls require deployment-specific verification. This overview does not assert that every provider disables training, retains no data or uses only a particular region.

Any commitment about generalized-model training or Customer Data commercialization must be verified and agreed in writing before being represented as applicable to a deployment.

12. Retention, termination and requests

Customer Data retention, export, return and deletion must follow applicable agreements, processing purposes and law. Active data, audit history and retained copies may have different handling; an account closure does not imply instantaneous deletion from all systems.

Customers and individuals may contact privacy@stract.us to ask about access, correction, deletion or other applicable rights. Requests may require identity or authority verification and coordination with the controlling Customer.

13. Enterprise diligence and contact

Request the applicable MSA, Order Form, DPA, Security Exhibit, offered SLA, private-instance or white-label addendum, subprocessor list and implementation SOW as appropriate. These materials are separate from public policies and are not automatically offered on identical terms to every customer.

Contact legal@stract.us for contractual diligence and privacy@stract.us for privacy or security inquiries, or use the STRACT contact form. Request deployment-specific provider and security information through STRACT’s enterprise diligence process.