Security

The APIs, and everything they store, run on Amazon Web Services in London (eu-west-2). Requests to api.stratumapis.com go straight to AWS. The website and dashboard are served by Cloudflare.

• The single APIs (sanctions, export, FCA, company, property): the names and details you send to be checked are not stored. We keep a monthly count of calls per key for billing. A PEP answer is kept for 24 hours, under a one-way hash of the query, so a repeat check the same day isn't paid for twice.
• The transactions API keeps each job you create (its parties, what was checked and the results) because that is the record you are building: results and certificates for 7 years, the record regulated firms are expected to keep.
• Watchlists keep the names you add until you remove them. Full retention periods are in our privacy policy.

• All traffic is encrypted with TLS. Data stored in AWS is encrypted at rest.
• An API key is shown to you once. We store only its SHA-256 hash, so nobody (us included) can read your key back. A revoked key stops working at once.
• Our own secrets (source credentials, signing keys) are kept in AWS Systems Manager, not in code.

Sign-in to our AWS account uses multi-factor authentication. The websites each have their own AWS key that can reach only the tables that site needs. Nobody outside Stratum APIs has access to production.

Customer tables have point-in-time recovery (any moment in the last 35 days) and deletion protection, and the certificates store keeps earlier versions of every file. A mistake, ours or a script's, can be undone.

An automatic check calls the website and the API every 5 minutes and alerts us if either stops answering, and errors in the APIs reach us within half an hour. Daily checks run real lookups against our sources and tell us if an answer is wrong or a list is out of date. You can see each API answering live on the status page.

If a security incident affects your data, we email the address on your account without undue delay, and in any case within 72 hours of confirming it: what happened, which data is involved, what we have done and what you may need to do. Where you are the controller of that data, this gives you what you need for your own report to the ICO.

Each certificate is recorded by its SHA-256 hash when we issue it. Anyone you share it with can confirm on our verification page that it is the document we issued, without seeing the personal data in it.

AWS (London), Stripe, Clerk, Resend (Ireland), Cloudflare, Anthropic (contact form messages only) and, for PEP checks only, OpenSanctions (Berlin). What each one sees is in section 6 of our privacy policy.

Email security@stratumapis.com with what you found and how to reproduce it. We reply to every report. Please don't test against other customers' data or run load tests; penetration testing needs our written consent first (see the acceptable use policy).

Building Stratum into your product and need a security questionnaire answered or a data processing agreement? Email security@stratumapis.com, or see working with platforms.