Legal and policies

The binding documents between your organization and Kronisys Inc., where they live, and how acceptance is recorded.

The three documents

Strata is governed by three documents, all maintained at strata.kronisys.com/legal/. Enterprise customers may additionally execute a Data Processing Addendum and Service Level Agreement via an Order Form.

Each document carries an effective date on its hero strip. The marketing site versions are authoritative. The application server proxies them for in-app rendering during the onboarding flow.

Where they are accepted

During the organization onboarding wizard, Step 5 — Legal asks the admin completing onboarding to:

1. Scroll each of the three documents to the end. Each document's acceptance checkbox stays disabled until you have scrolled to the bottom of that document.
2. Tick the acceptance checkbox for each, which reads: "I have authority to bind [your organization] to the [Terms of Service / Privacy Policy / Usage Policy]." Checking the box is the confirmation that you have authority to bind the organization to that document.

Only when all three boxes are checked does the wizard's Continue button enable. Advancing past the step writes the acceptance record (see below).

Acceptance of all three documents is mandatory and enforced server-side. The onboarding completion endpoint returns an error if the submitted legal_accepted payload does not include all three required slugs (terms, privacy, usage) as accepted — onboarding cannot complete without it. The acceptance record captures the accepting admin, the timestamp, the admin's IP address and browser user agent, each document's effective-date version, and a SHA-256 hash of the exact text that was displayed at the moment of acceptance.

What is recorded at acceptance

The organizations row stores:

The SHA-256 matters: if Kronisys updates a document later, the previously stored hash still proves exactly what wording the org agreed to. If a dispute ever arises about whether section 7.b of the Terms looked different in 2026 vs. 2028, Strata can produce the hash of the document content as it appeared at acceptance time.

Re-viewing the documents

Members can re-read the active versions at any time:

• From their personal Settings → Privacy page, the Learn more link opens the Privacy Policy in a new tab.
• From the Strata sidebar account menu, Learn more lists Documentation, Usage policy, and Privacy policy — each opening the live document in a new tab.
• The Teams bot manifest declares the Terms and Privacy URLs (termsOfUseUrl, privacyUrl) so Microsoft Teams clients display them on the bot's install screen.

Direct browser links work too:

• https://strata.kronisys.com/legal/terms
• https://strata.kronisys.com/legal/privacy
• https://strata.kronisys.com/legal/usage

Sub-processors

The full, authoritative sub-processor list lives in the Privacy Policy. The headline list:

• Microsoft Azure — application hosting, database, blob storage, identity (Entra ID), AI Foundry, communication services.
• Microsoft Graph — OneDrive, Outlook, SharePoint, and Teams access when those extensions are connected.
• Atlassian (Jira and Confluence Cloud) — Jira Software, Jira Service Management, and Confluence access when Atlassian is connected and your organization has enabled the product.
• The model providers behind the AI Model Catalog — every model Strata offers runs through Microsoft Azure AI Foundry. The catalog spans models from OpenAI, Anthropic, xAI, DeepSeek, Mistral AI, Cohere, and Microsoft. The exact set in play for your organization is whatever you have enabled in the Model Catalog; the Privacy Policy carries the complete provider disclosure.

Atlassian is Strata's connector outside the Microsoft boundary, and it covers two governed products: Jira and Confluence. Jira issues, comments, and service requests, and Confluence pages and page comments, are read from — and, if your organization has enabled writes for that product, written to — Atlassian Cloud directly, not through Microsoft Graph, so the sub-processor for that traffic is Atlassian rather than Microsoft. Atlassian pins that data to the region the site was created in; Strata's platform database and your organization's Azure AI Foundry are separate infrastructure in their own regions. An organization that needs every connector to stay inside the Microsoft boundary has to leave both Jira and Confluence unchecked — leaving either one enabled still sends content to Atlassian Cloud.

Inference always passes through Foundry — Foundry is a Microsoft service, and the AI provider's API contract applies. Strata never calls a model provider directly.

Every organization runs on its own Azure AI Foundry: all inference happens through your Azure subscription's Foundry deployments — your Foundry, your region, your bill — and Strata never talks to a model provider outside it.

See Data handling and privacy for the sub-processor table in context.

How AI requests are routed

Chat prompts and context flow from the Strata App Service → your organization's own Azure AI Foundry (in your Azure tenant) → the model provider's hosted endpoint. Foundry acts as the security boundary; the model provider sees the request payload but cannot see organization metadata. Your Foundry, your Azure subscription, your bill — and Strata never persists Foundry responses beyond what is needed to render and save the chat.

No path sends your data to a model provider's training pipeline. Inference-only.

Reporting concerns

What can go wrong

See Data handling and privacy for the underlying data model, Security overview for the security posture, and the live documents at the URLs above.

Related

• Security overview
• Data security