Privacy notice

1. Who is the controller

The controller for personal data collected through stratumapis.com, the Stratum app and the public APIs is Amir Naghieh, a sole trader trading as Stratum. Our postal address is on the legal information page. Our data protection contact is dpo@stratumapis.com. We are registered with the Information Commissioner's Office, registration number ZC273024.

For your clients’ data, your firm is the controller and we are your processor: our data processing terms set out how we handle it.

2. What we collect and why

3. What we do not collect

We do not collect special-category data (health, race, religion, biometric) for ourselves. The one place it comes near us is an ID check by link (section 5): the selfie video is collected by the identity service, used only to check that the face matches the document, and never sent to us; the report we keep for you can include a still image from it. We do not run advertising trackers. We do not sell personal data.

4. Names you send to the single APIs

When you screen a name (with any date of birth, nationality or reference you add) through the Sanctions Screening API, we process it in AWS London only to run the screen and return the result. We do not store the names, the inputs or the results, and we do not write them to our logs. For this data you are the controller and we act as your processor. Names you add to a sanctions watchlist are stored so we can re-screen them daily, until you delete them; each day's changes are kept for 30 days for the changes feed.

5. ID checks by link

When you send someone an ID check link, from a client’s page in your register or through the Transactions API, we pass their name, email address and (if you gave it) date of birth to Vouchsafe, the identity service that runs the check. On their phone, Vouchsafe collects a photo of their ID document and a short selfie video (biometric data, used only to check that the face matches the document). We receive back the outcome, the details read from the document (name, date of birth, document type, issuing country, expiry date and the last four characters of the document number) and Vouchsafe's PDF report of the check, which can include a copy of the document and a still image from the selfie. We don't receive the selfie video. The page the person opens (stratumapis.com/id/...) shows only your firm's name and their first name. For this data you are the controller and we act as your processor.

6. The data your API requests return

API responses contain data from public registers (FCA, Companies House, the UK, UN, EU and US sanctions lists, and similar bodies). Where they contain personal data of regulated individuals, you are the controller for your use of it. Our role is processor where we cache responses for performance, and controller for the operational metadata (timestamps, your usage counts, and your FCA Verification audit log).

7. Sub-processors

We use these companies. Each is bound by written data protection terms.

• Amazon Web Services (London (eu-west-2)): Storing your register, check results, certificates and documents; running the checks; sending the morning alert email (Amazon SES).
• OpenSanctions Datenbanken GmbH (Germany (EU)): PEP checks: the person’s name, and date of birth and nationality if given.
• Cloudflare (Its global network): Hosting the website and app, through which your data passes, and receiving email sent to our addresses.
• Vouchsafe (Interrobang Limited, company 14466175) (United Kingdom): ID checks by link, sent from a client’s page in your register or through the Transactions API: the person’s name, email and (if given) date of birth; it collects their ID document and selfie from them directly, and keeps the images while we use its service unless we ask it to erase them.
• Clerk (United States): Signing in: your team’s names and email addresses (not your clients’ data).
• Resend (European Union (Ireland)): Account emails and replies to enquiries (not the morning alert email).
• Stripe (European Union and United States): Payments for your plan and any extra checks, and API balance top-ups: your firm’s billing details and card (not your clients’ data).
• Anthropic (United States): Reading and sorting messages sent through our contact forms, so the right person answers (never your clients’ data).

8. Where data is stored

Your register, documents, the APIs and our operational data run in AWS eu-west-2 (London). Resend (Ireland) and OpenSanctions (Germany) are in the EU, which the UK recognises as adequate. Some companies (Stripe, Clerk, Cloudflare, Anthropic) may process data outside the UK; we rely on UK International Data Transfer Agreements and the EU Standard Contractual Clauses with the UK Addendum where they apply.

9. Retention

• Your clients’ data in the register: as set out in section 6 of our data processing terms (while you act for a client; five years after you archive them, then deleted).
• Your firm and team: for the life of your account. A person you remove loses access; what they did stays in your audit trail.
• The morning alert email: we keep that it was sent and to how many people, not its text.
• Names, dates of birth, nationalities and references you send to the single APIs to be screened: not stored. A PEP answer is kept for 24 hours under a one-way hash of the query, so a repeat check isn't paid twice.
• Transactions API jobs (the parties, what was checked, the results): kept with your account as your record; check results and certificates 7 years. The audit entry for each check: 1 year.
• ID check reports: for a client in your register, deleted with the client (five years after you archive them, or sooner if your firm’s owner deletes them), and in any case 6 years after the check; through the Transactions API, 5 years after you mark the job complete (6 years after the check if you never do), and you can delete one sooner once you have filed your own copy. Vouchsafe keeps its own copy of the images while we use its service, unless we ask it to erase them sooner.
• Sanctions watchlist entries: until you delete them (or ask us to). Watchlist changes: 30 days.
• Account and billing records: for the life of your account, plus 6 years for tax purposes.
• API key hashes: kept with your account records; a revoked key stops working at once.
• Operational logs: 30 days.
• Messages sent through our contact forms: 365 days, then deleted automatically.

10. Your rights

Under UK GDPR you have the rights of access, rectification, erasure, restriction, portability and objection in respect of personal data we hold about you. To use any of them, email dpo@stratumapis.com. We aim to respond within 30 days. If you are a client of a firm that uses Stratum, the firm is the controller of your data: ask them first, and we will help them answer. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.

11. Cookies

We use only the cookies the site and app need to work (the sign-in session cookie issued by Clerk; cookies during Stripe checkout). We do not run advertising or analytics cookies. If we add an analytics provider, it will be a privacy-preserving one and we will update this notice at least 30 days before.

12. Security

Data in transit is encrypted with TLS and data at rest in AWS with AWS-managed keys; secrets are kept in AWS Systems Manager Parameter Store; sign-in to our AWS account uses multi-factor authentication; and each website has its own AWS key limited to what it needs. We never keep API keys in plain text after issuing them: only their SHA-256 hash.

13. Children

The service is not directed at children under 16. We do not knowingly collect data from anyone under that age.

14. Changes to this notice

We may update this notice. Material changes are emailed to the address on your account at least 30 days before they take effect. The current version is always at this address.