Security & Data
Your strategy is sensitive. We treat it that way.
Limitations, competitive reads and unreleased plans aren't information you want floating around. Here's what actually protects it.
Each organization's data is isolated
Every request is scoped to the organization making it, enforced on the server for every read and write — not just hidden in the interface. One workspace can never see another's Limitations, scores, plans or saved sessions.
Reviewers can look without touching
The Reviewer role can read a strategy, comment on it, and propose changes — but every one of those proposals stays a private draft until the workspace's Owner or an Editor chooses to apply it. The live strategy never changes underneath you.
Nothing is lost to a bad edit
Your work saves automatically as you go, and you can save named checkpoints at any point and restore any of them later — a real, working version, not just an undo history.
Built on established infrastructure
Authentication runs through Clerk, the database runs on Neon (managed Postgres), and the application is hosted on Vercel — named, independently operated services, not a home-grown system handling your credentials or your data at rest.
Being direct about what this isn't
No formal certification exists yet
StrategySOS does not currently hold a SOC 2 report or a similar third-party audit. If that's a requirement for your organization, ask before you rely on us for anything regulated or highly sensitive — we'd rather tell you plainly than let you assume otherwise.
Read the full Privacy Policy →See it for yourself
Building and scoring your strategy is free — a good way to see how the isolation and roles actually work.
Get started