Security & Trust

Last updated: August 2026 · Security contact: security@strama.ai

Strama connects to the tools your sales team already uses — email, calendar, LinkedIn, and your CRM — to research prospects and draft outreach that sounds like you. That access is a serious responsibility. This page explains exactly what we access, where it goes, and how it is protected, so your security team can evaluate us without a call. Questions or anything missing? Email security@strama.ai.

1. What data we access

Signing in to Strama and connecting an inbox are separate grants. Sign-in with Google or Microsoft requests basic identity only (openid email profile); Strama never sees or stores a password. Mailbox, calendar, and CRM access are requested only when you explicitly connect those accounts, with the scopes below.

Google and Microsoft mailbox grants are all-or-nothing: if a scope is declined at the consent screen, the connection is rejected rather than silently degraded, so a connected inbox always has exactly the scopes listed above — never more. HubSpot is the exception, with the two optional scopes noted in the table.

2. AI and model providers

The following model providers process customer data on Strama's behalf:

• Google (Gemini API) — the primary model provider for all generation: sequence drafting, reply suggestions, research reports, and summaries.
• Mistral OCR (served via Google Cloud Vertex AI) — text extraction from documents you upload to the Library.
• Deepgram — transcription of call recordings and voicemail, when the phone product is enabled.
• Recall.ai — meeting recording and transcription, when meeting bots are enabled.

Directly, and in plain terms:

• Is customer data used to train models? No. Strama does not train or fine-tune any model on customer data. Our model providers are accessed under paid API terms that exclude the use of customer inputs and outputs for model training — Google's paid Gemini API terms state that prompts and responses are not used to improve Google's models, and every Deepgram transcription request explicitly opts out of Deepgram's Model Improvement Program, so call and meeting audio is never used to train their models.
• Do providers retain data? Requests are processed transiently; providers may retain inputs for a limited period for abuse monitoring under their API terms, and do not retain customer data for model training.
• Do we log prompts and outputs? No. Our analytics record token counts, model names, and operation types — not prompt or output content — and error diagnostics are automatically scrubbed of prompts, model outputs, and message bodies before they reach our error-monitoring vendor.
• Is data ever combined across customers? No. Every AI request is constructed solely from the requesting team's own data. There is no cross-customer pooling, shared fine-tuning, or shared retrieval index across teams.
• Does Strama learn from your content? Only within your own workspace: for example, when your team edits AI drafts, those edits refine your team's writing style guide. That learning is scoped to your team and is deleted with your data.

3. Infrastructure and hosting

• Hosting: Vercel (application and serverless compute).
• Database: PlanetScale (managed MySQL), hosted on AWS in the United States.
• File storage: Cloudflare R2 (uploaded documents), Vercel Blob (images and assets).
• Background processing: Google Cloud Tasks and AWS SQS.
• Regions: United States.

Our infrastructure providers hold their own SOC 2 Type II and ISO 27001 certifications, which Strama inherits at the infrastructure layer. Those certifications are the providers', not Strama's — our own compliance posture is described in section 9.

• Tenant isolation: shared database with strict per-team isolation enforced at the application layer. Every authenticated request resolves a team membership server-side before any data is read; a tampered client cannot select another customer's team.
• Backups: the database is backed up automatically every 12 hours; backups are encrypted and retained for 2 days on a rolling basis.

4. Encryption

• In transit: TLS 1.2+ for all external traffic; HTTPS is enforced on every endpoint.
• At rest: all databases and object stores are encrypted at rest with AES-256, managed by the respective infrastructure providers (PlanetScale, Cloudflare, Vercel).
• Credentials: Strama stores no user passwords — authentication is delegated entirely to Google, Microsoft, or emailed magic links. OAuth tokens for connected accounts are stored in the encrypted-at-rest database with access limited to the application.

5. Internal access control

• Production access is limited to Strama's two founders — there are no other employees or contractors with access to customer data.
• Internal systems are accessed through Google Workspace accounts; customer data is accessed only to operate the service and for support and debugging.
• All third-party service credentials are held in managed secret stores, not in code.

6. Product security features

• No password database. Users sign in with Google, Microsoft, or an emailed magic link. Because authentication is delegated to your identity provider, your existing MFA and conditional-access policies apply to Strama sign-in automatically.
• Roles and permissions. Workspaces have Owner and Member roles. Billing, domain, and phone-line administration are restricted to Owners. Campaigns, senders, scorecards, and booking links carry their own per-member access controls.
• Team isolation. Members only see data belonging to teams they have been invited to; membership is verified server-side on every request.

On our roadmap (not yet available — we'd rather tell you directly than let you find out mid-questionnaire): SAML SSO and SCIM provisioning, customer-visible audit logs, and self-service data export.

7. Data retention and deletion

• Disconnecting an integration immediately stops all syncing: mailbox and calendar webhooks are torn down and the stored credentials are deleted. Previously synced records remain in your workspace until you delete them or close your account.
• Account closure: contact support@strama.ai and we will delete your workspace data within 30 days of the request. Data is deleted, not anonymized.
• Backups: deleted data ages out of encrypted backups within 2 days of deletion under our rolling backup retention.

8. Subprocessors

These vendors process customer data on our behalf. Integrations you connect yourself (Google, Microsoft, HubSpot, Salesforce, LinkedIn) are data sources you control, not subprocessors, and are covered in section 1.

We update this list at least 15 days before a new subprocessor begins handling customer data.

9. Assessments and compliance

• CASA Tier 2: completed in 2025 by TAC Security, an App Defense Alliance authorized lab, as part of Google's verification for restricted Gmail scopes. Our 2026 reassessment is currently in progress.
• Google OAuth verification: Strama is a Google-verified app; access to restricted Gmail scopes is reviewed by Google.
• SOC 2: not currently held. Contact us for our current plans.
• GDPR / CCPA: Strama acts as a data processor for the customer data you bring into the platform. We honor data-subject rights requests (access, correction, deletion) within 30 days via support@strama.ai, and we do not sell personal information. Customer data is hosted in the United States.

10. Incident response

If a security incident affects your data, we will notify affected workspace owners without undue delay and no later than 72 hours after confirming it. Contact: security@strama.ai.

11. Vulnerability reporting

Found a vulnerability? Email security@strama.ai — we acknowledge reports within 3 business days. We will not pursue legal action against researchers who act in good faith, avoid privacy violations and service disruption, and give us reasonable time to remediate before disclosure.

12. Personnel practices

Strama is built and operated by its two founders; no one else has access to customer data today. Both founders are bound by confidentiality obligations. As the team grows, new employees will complete background checks and security onboarding before receiving any access to customer data.

Related documents

• Privacy Policy
• Terms of Service

Changelog

• August 2026 — initial publication.