Security and data protection (Trust)

Last updated: October 20, 2026

Strike's platform is designed under secure-by-default principles, ensuring the protection of customer information at every stage of the process.

Data use and AI models

Is my data used to train models?
No. Customer data is never used to train artificial intelligence models. The platform operates in inference mode only: data is processed, but not stored or reused.

Is data shared with other customers?
No. Each customer operates in a fully isolated environment:

  • There is no shared memory.

  • There is no cross-access between organizations.

Is data shared with third parties?
No. Strike does not sell or share customer data. Information is used exclusively to operate the platform and provide the service.

What about external AI models?
The model providers the platform uses:

  • Do not store or use data for training.

  • Do not retain information beyond immediate processing.

Strike sends only strictly necessary information, and data is filtered and sanitized before any interaction.

Data handling and storage

  • Data encrypted in transit (TLS) and at rest.

  • Role-based restricted access.

  • Storage on secure infrastructure (AWS).

Only authorized personnel can access it when necessary.

What happens when a run ends?
The run context is deleted, temporary data is erased, and the environment used is destroyed. No unnecessary persistence remains.

Customer control

Can I control what kind of testing is run?
Yes. In each Threat Emulation, you can set restrictions on:

  • Brute force

  • DoS

  • Destructive payloads

  • Data exploitation

This lets you adapt the testing to your risk appetite.

Can I stop the testing?
Yes. The platform includes a kill switch (Cancel execution) to stop runs in real time. Learn about the rest of the controls in How Strike's AI agent operates.

Human oversight

Strike operates under a Human-in-the-loop model. Every finding goes through triage by Strike's Hacking Team before it is published, and 100% of critical findings are also reproduced and validated manually. The team is responsible for:

  • Validating findings.

  • Removing false positives.

  • Assessing real impact.

AI assists, but decisions are made by humans.

Compliance and certifications

Strike is certified in:

  • ISO 27001

  • SOC 2

  • HIPAA

Information security is not an add-on, but a core principle in the design and operation of the platform.