Security summary
Strataigize, one page for your vendor review. Full detail at strataigize.com/trust/. The date below records when you printed
- Legal entity
- Strat-Ai-Gize Marketing & Automation Ltd., British Columbia, Canada. Founded 2023. 700 W Georgia St, Vancouver, BC V7Y 1B6. Phone 604-720-3967.
- Service scope
- Growth marketing, in-house development and AI automation delivered through client-granted platform access. No payment processing, no customer accounts, no hosting of client production systems.
- Access model
- Least privilege through platform-native roles the client grants and can revoke instantly (Meta Business Manager, Google Ads, and equivalents). We never hold client logins. Business-critical accounts carry multi-factor authentication; credentials live in managed stores, never in code.
- Change discipline
- Read-only analysis by default. Changes to budgets, campaigns or client-facing systems are approved by a named human, either per change or in advance as a signed policy with hard bounds.
- Data handling
- Campaign data stays in the client’s own platforms. Website leads go to HubSpot. No sale of data, no sharing beyond listed subprocessors, return or deletion of client materials on request at engagement end.
- AI governance
- Aligned to the four functions of the NIST AI Risk Management Framework (no certification is claimed; NIST offers none). Commercial model APIs under terms that exclude training on client inputs and outputs. When our own agents work in client accounts, anything that moves money, messages a client, or writes to a client system requires explicit approval from a named person, per action or in advance as a signed policy. Systems we build for clients run on their own inside the limits the client sets, check their own work and flag the exceptions.
- Subprocessors
- Cloudflare (hosting, security), HubSpot (CRM, scheduling), Google (analytics, ads), Meta (ads), PostHog (product analytics on our website), Anthropic (AI processing). Complete current list ships with the DPA.
- Certifications
- No third-party security certification is held today. We complete vendor security questionnaires on request; a formal audit is triggered by client requirements. Verified certifications are published at strataigize.com/trust/ the day they are real.
- Privacy regime
- Headquartered in Canada, operating under PIPEDA. A DPA covering processing scope, subprocessors, breach notification, data subject requests and deletion is available on request, including GDPR-style processor obligations.
- Vulnerability reports
- Security contact: ian@strataigize.com. Good-faith research is acknowledged, never met with legal action.
Prepared by Strataigize · strataigize.com · ian@strataigize.com ·