Data classification & minimization
Identify sensitive information, document how it moves, and limit collection and use to the business purpose. Assess separation, tokenization, or de-identification where appropriate.
Security and trust
We consider privacy, security, and data governance alongside business requirements and engineering. Controls, data access, and contractual requirements are defined for each engagement.
Our approach
The appropriate design depends on the information involved, intended users, applicable requirements, and deployment environment.
Identify sensitive information, document how it moves, and limit collection and use to the business purpose. Assess separation, tokenization, or de-identification where appropriate.
Design permissions around roles and purposes. Agree on authentication, access review, audit logging, and the process for removing access.
Define shared metrics and ownership, track data origins, and agree how data quality, retention, and deletion are managed.
Limit tools to approved data and actions. Consider prompt and output handling, model-provider terms, logging, and human approvals where actions have consequences.
Agree on hosting, encryption, monitoring, and incident responsibilities. Review where team members and service providers may access information.
Review sector-specific needs and required agreements before work begins. Confirm the scope of any healthcare, education, or other regulated-data work with the relevant stakeholders.
Vendor review
Discuss the documentation and controls required for your engagement. Certifications, testing reports, insurance coverage, and contractual commitments should be confirmed through the review process rather than inferred from this website.
Data access, specialist involvement, service providers, locations, and security responsibilities are agreed for the project. Contact us before submitting sensitive or confidential information.
Running a vendor review?
Tell us your security and procurement requirements at info@stravolabs.com.