01
Authorization first
Security testing and analysis must stay within systems Stratic owns, operates, or is explicitly authorized to test.
SECURITY AT STRATIC SYSTEMS
Trustworthy engineering intelligence requires clear security boundaries.
Stratic Systems LLC develops engineering software, applied AI capabilities, and integrations that interact with technical systems and data. Security is part of how those systems are designed, tested, operated, and reviewed.
Authorized
Testing stays within approved scope.
Controlled
Access and integrations use defined boundaries.
Reviewable
Findings and consequential actions remain subject to human review.
SECURITY PRINCIPLES
Security is an engineering process, not a marketing badge.
Stratic's security approach centers on authorization, scoped access, reproducible evidence, human oversight, and a clear path for reporting potential vulnerabilities.
02
Least privilege
Applications, integrations, users, and services should receive only the access required for the intended workflow.
03
Evidence & review
Security findings should be reproducible, traceable to evidence, and reviewed before consequential remediation or disclosure decisions.
04
Responsible disclosure
Potential vulnerabilities should have a clear reporting path so they can be investigated and corrected without unnecessary risk to users or systems.
SECURE DEVELOPMENT
Security belongs inside the software lifecycle.
Stratic develops software that connects CAD, engineering workflows, cloud services, APIs, and external systems. The security program is therefore built around defensive review of the software and infrastructure Stratic is responsible for.
APPSEC
Secure code review
Review application changes for authentication, authorization, input-handling, secrets, data exposure, and other security-relevant behavior.
SUPPLY CHAIN
Dependency review
Track third-party packages and software dependencies so known vulnerabilities, risky updates, and remediation work can be evaluated.
DESIGN
Threat modeling
Consider assets, trust boundaries, permissions, attack paths, and failure modes when designing new services and integrations.
REMEDIATION
Patch validation
Reproduce findings where practical, correct the underlying issue, and verify that the change addresses the reported condition without creating a new failure.
ACCESS
Credential & secret handling
Keep credentials and service secrets out of public source and limit their use to authorized environments and workflows.
INTEGRATIONS
Scoped permissions
External integrations should request and use only the permissions required for the enabled workflow, with system boundaries kept visible enough to review.
AUTHORIZED CYBERSECURITY WORK
Advanced security capability stays inside an authorized defensive scope.
Stratic may use security tools and AI-assisted analysis to strengthen software and infrastructure that Stratic owns, operates, or has explicit permission to assess. Access to advanced security capability is intended for approved internal users and authorized work only.
Stratic does not treat access to a powerful security tool or model as authorization to test a third party. Scope and permission come first.
01
Secure SDLC / application security
Secure code review, vulnerability triage, dependency review, threat modeling, remediation, and patch validation.
02
Defensive investigation
Analyze suspicious behavior, application failures, security findings, and relevant logs or evidence in systems Stratic is authorized to review.
03
Controlled validation
Reproduce or validate a suspected weakness in Stratic-owned test environments or other environments where explicit authorization exists.
04
Human oversight
Security findings, elevated actions, disclosure decisions, and potentially destructive operations remain subject to human review and authorization.
RESPONSIBLE VULNERABILITY DISCLOSURE
Found something? Report it directly so we can investigate it.
Send security reports to security@Stratic.pro. A useful report includes the affected asset, a concise description, reproduction steps, observed impact, and enough evidence to validate the issue without including unnecessary sensitive data.
PLEASE DO
• Report the issue promptly and privately.
• Minimize access to data and stop if sensitive user information is encountered.
• Use the least intrusive verification necessary to demonstrate the issue.
• Preserve timestamps, request IDs, URLs, versions, or other reproducible evidence.
• Allow a reasonable opportunity to investigate and remediate before public disclosure.
PLEASE DO NOT
• Perform denial-of-service, destructive, or availability-impacting testing.
• Use social engineering, phishing, physical intrusion, extortion, or coercion.
• Establish persistence, deploy malware, exfiltrate data, or access more data than required to validate a report.
• Test third-party providers or infrastructure that Stratic does not own without separate authorization.
• Run aggressive automated scanning that creates unnecessary load or operational risk.
This disclosure policy is not blanket authorization for intrusive security testing. If active testing would go beyond ordinary use or low-impact verification, request written authorization from Stratic Systems first. Stratic does not currently operate a public bug bounty and does not promise compensation for vulnerability reports.
DATA & ACCESS BOUNDARIES
Security depends on knowing what each system is allowed to access.
Different Stratic applications may interact with CAD, project, manufacturing, business, cloud, or AI services. The intended boundary should be explicit for the specific workflow rather than assumed to be identical across every product.
DATA
Customer-controlled information
Customer drawings, CAD files, project records, credentials, and proprietary business information remain subject to the applicable product configuration, authorization, privacy terms, and deployment model.
ACCESS
Least necessary scope
Integrations should use only the accounts, permissions, records, files, or actions required to perform the approved workflow.
PRIVACY
Document the data path
Sensitive information should not be placed into a connected or AI-assisted workflow unless the organization understands and approves that data path.
CONTROL
Review & revoke
Where practical, connected-system access should remain identifiable enough to review, troubleshoot, disable, or revoke.
SECURITY ASSURANCE
We prefer accurate claims over impressive-sounding claims.
Security practices evolve as Stratic's products, infrastructure, integrations, and customer requirements evolve. This page describes Stratic's current security direction and reporting policy; it is not a guarantee that every control applies identically to every product or environment.
Unless Stratic Systems expressly states otherwise in writing, we do not represent the company or its products as SOC 2, ISO 27001, FedRAMP, PCI DSS, or other independently certified environments.
SECURITY CONTACT
Stratic Systems LLC
Security reports: security@Stratic.pro
Privacy questions: privacy@Stratic.pro
Legal questions: legal@Stratic.pro
General company contact: STX@StraticSystems.com
North Georgia, United States · Last updated September 4, 2026