Security and account controls
These are product controls you can use today. They do not eliminate every risk, and this page makes no certification claim.
Control access to your account
Your account supports authenticator-based two-step sign-in and recovery codes. You can review signed-in devices and revoke other sessions. Business owners can require two-step sign-in for their team.
Keep businesses separate
The API verifies business and workspace membership on requests. Tenant-owned database records use PostgreSQL row-level security. Workspace roles can limit actions and content kinds; owners control team access.
Protect connected credentials
Provider credentials stored by Stratafold are encrypted with AES-256-GCM and bound to their business context. Secret values are not returned in ordinary settings responses. API access keys have a defined scope and can be revoked.
Review before publishing
AI suggestions are drafts. Approval requirements can be enabled for a kind of content, and editing an approved version requires a new approval. Hosted customer websites use a separate domain from the dashboard.
Export your work
Owners can download business records and original files before deleting a business. Account credentials and private recovery messages are excluded from the archive.
Report a security concern to stratafold@bakaroart.com. Do not include passwords or API keys in your initial message.
Read the privacy policy