Legal and policies

The binding documents between your organization and Kronisys Inc., where they live, and how acceptance is recorded.

The documents

Strata is governed by a set of documents maintained at strata.kronisys.com/legal/. Three of them — the Terms of Service, Privacy Policy, and Usage Policy — are accepted during onboarding and bind every organization. The rest are published references, some of which enterprise customers additionally execute via an Order Form.

Accepted at onboarding

Additional published documents

Each document carries an effective date on its hero strip. The marketing site versions are authoritative. The application server proxies the three onboarding documents for in-app rendering during the onboarding flow.

Where they are accepted

During the organization onboarding wizard, Step 5 — Legal asks the admin completing onboarding to:

1. Scroll each of the three documents to the end. Each document's acceptance checkbox stays disabled until you have scrolled to the bottom of that document.
2. Tick the acceptance checkbox for each, which reads: "I have authority to bind [your organization] to the [Terms of Service / Privacy Policy / Usage Policy]." Checking the box is the confirmation that you have authority to bind the organization to that document.

Only when all three boxes are checked does the wizard's Continue button enable. Advancing past the step writes the acceptance record (see below).

Acceptance of all three documents is mandatory and enforced server-side. The onboarding completion endpoint returns an error if the submitted legal_accepted payload does not include all three required slugs (terms, privacy, usage) as accepted — onboarding cannot complete without it. The acceptance record captures the accepting admin, the timestamp, the admin's IP address and browser user agent, each document's effective-date version, and a SHA-256 hash of the exact text that was displayed at the moment of acceptance.

What is recorded at acceptance

The organizations row stores:

The SHA-256 matters: if Kronisys updates a document later, the previously stored hash still proves exactly what wording the org agreed to. If a dispute ever arises about whether section 7.b of the Terms looked different in 2026 vs. 2028, Strata can produce the hash of the document content as it appeared at acceptance time.

Re-viewing the documents

Members can re-read the active versions at any time:

• From their personal Settings → Privacy page, the Learn more link opens the Privacy Policy in a new tab.
• From the Strata sidebar account menu, Learn more lists Documentation, Usage policy, and Privacy policy — each opening the live document in a new tab.
• The Teams bot manifest declares the Terms and Privacy URLs (termsOfUseUrl, privacyUrl) so Microsoft Teams clients display them on the bot's install screen.

Direct browser links work too:

• https://strata.kronisys.com/legal/terms
• https://strata.kronisys.com/legal/privacy
• https://strata.kronisys.com/legal/usage

Sub-processors

The full, authoritative sub-processor list — with locations and 30-day change-notice terms — lives at the Sub-processors page and is reproduced in the Privacy Policy and Annex II of the DPA. The headline list:

• Microsoft Azure — application hosting, database, blob storage, identity (Entra ID), communication services, and cache.
• Microsoft Graph — OneDrive, Outlook, SharePoint, and Teams access when those extensions are connected.
• Microsoft Azure AI Foundry and the model providers behind the AI Model Catalog — every model Strata offers runs through Foundry (your own tenant's). The catalog spans models from OpenAI, Anthropic, xAI, DeepSeek, Mistral AI, Cohere, and Microsoft; the exact set in play is whatever you enable in the Model Catalog.
• Atlassian (Jira and Confluence Cloud) — Jira Software, Jira Service Management, and Confluence access when Atlassian is connected and your organization has enabled the product.
• Brave Search — live web results when web search is enabled.
• Stripe — payment processing, invoicing, and subscription billing.
• Mapbox and Google Places — rendering maps, geocoding addresses, and place-card photos when Strata answers a location question.
• IP geolocation providers (ipapi.co, ip-api.com, ipwho.is) — approximate sign-in location from a truncated IP, when geolocation is enabled.
• MCP connectors — any additional connector an admin enables under Settings → Apps sends content to that connector's provider.

Which of these actually receive data depends on the models, extensions, and features your organization enables. The authoritative page carries the complete disclosure and the per-provider locations.

Atlassian is Strata's connector outside the Microsoft boundary, and it covers two governed products: Jira and Confluence. Jira issues, comments, and service requests, and Confluence pages and page comments, are read from — and, if your organization has enabled writes for that product, written to — Atlassian Cloud directly, not through Microsoft Graph, so the sub-processor for that traffic is Atlassian rather than Microsoft. Atlassian pins that data to the region the site was created in; Strata's platform database and your organization's Azure AI Foundry are separate infrastructure in their own regions. An organization that needs every connector to stay inside the Microsoft boundary has to leave both Jira and Confluence unchecked — leaving either one enabled still sends content to Atlassian Cloud.

Inference always passes through Foundry — Foundry is a Microsoft service, and the AI provider's API contract applies. Strata never calls a model provider directly.

Every organization runs on its own Azure AI Foundry: all inference happens through your Azure subscription's Foundry deployments — your Foundry, your region, your bill — and Strata never talks to a model provider outside it.

See Data handling and privacy for the sub-processor table in context.

How AI requests are routed

Chat prompts and context flow from the Strata App Service → your organization's own Azure AI Foundry (in your Azure tenant) → the model provider's hosted endpoint. Foundry acts as the security boundary; the model provider sees the request payload but cannot see organization metadata. Your Foundry, your Azure subscription, your bill — and Strata never persists Foundry responses beyond what is needed to render and save the chat.

No path sends your data to a model provider's training pipeline. Inference-only.

Security and responsible disclosure

Kronisys publishes a Security & Responsible Disclosure policy for security researchers. In brief:

• Safe harbor — good-faith research conducted within the policy's scope is treated as authorized; Kronisys will not pursue legal action against researchers who comply.
• Scope — the Strata application (app.strata.kronisys.com) and its API, the marketing and docs site (strata.kronisys.com), and kronisys.com. Third-party systems and sub-processors are out of scope and should be reported to that vendor.
• Coordinated disclosure — a default 90-day window from acknowledgment before public disclosure.
• Response commitments — acknowledgment within five business days and an initial assessment within fifteen.

Report to legal@kronisys.com with the subject "Security Report", or use the machine-readable contact at /.well-known/security.txt.

Reporting concerns

What can go wrong

See Data handling and privacy for the underlying data model, Security overview for the security posture, and the live documents at the URLs above.

Related

• Security overview
• Data handling and privacy
• Data-loss-prevention policy hook