Institutional controls
Role-based access, tenant isolation, scoped credentials, approval and operational evidence are described.
EVIDENCE POSITION
Descriptions and assurance
are not the same thing.
Based on the supplied feature inventory dated 10 September 2026. Reconfirm the position during procurement.
SOC 2 report
The inventory explicitly says that Stretus currently has no SOC 2 report.
ISO 27001 certification
The inventory explicitly says that Stretus is not currently ISO 27001 certified.
Third-party penetration test
A publishable third-party penetration-test summary is not available in the supplied evidence.
Named team profiles
The operating company is identified. Named team profiles remain a content and diligence gap.
Deployment assurance
Verify residency, isolation, recovery, access and support against the proposed deployment.
MAKE DILIGENCE ACTIONABLE
Request the artefact.
Review the boundary.
Not every artefact is currently available. Request confirmation of availability rather than assuming a data room exists.
Start an evaluation enquiry- Architecture and data flow for the proposed deployment.
- Permission, credential and tenant-boundary demonstrations.
- A representative strategy approval and order-evidence record.
- Incident, change, backup and recovery responsibilities.
- Executed contractual terms and relevant security evidence.
CONNECTED CAPABILITIES
Continue the evaluation.
START WITH YOUR REQUIREMENTS
Start with your diligence requirements.
Share the evidence and operating constraints your institution needs to evaluate.