Security & trust

1. Principles

• EU-first infrastructure: public site and inquiry intake hosted in the EU.
• Least privilege: access to inquiry data limited to authorised personnel.
• Transport security: HTTPS/TLS with HSTS on sternary.com.
• Privacy by design: no advertising trackers on the marketing site by default.
• Separation of concerns: marketing site ≠ production application trust boundary; product security documentation is shared in investor/partner diligence.

2. Public website controls

• TLS certificates via Let’s Encrypt with automated renewal
• Security response headers (HSTS, frame protections, content-type nosniff, referrer policy)
• Form intake rate limiting and honeypot anti-spam
• Inquiry records stored on EU filesystem with restricted OS permissions

3. Platform direction (product)

The Sternary application architecture targets European hosting regions, supplier verification workflows, and communication designs that separate commercial messaging from advertising profiling. Payment and escrow capabilities are intended to integrate with regulated European financial partners — Sternary itself is not presenting itself as a licensed bank or payment institution on this Site.

4. Compliance roadmap

• GDPR operational programme for product data (policies, RoPA, vendor DPAs)
• Periodic vulnerability review / penetration testing before broad launch
• Evaluation of ISO 27001 / SOC 2 as the organisation scales

Roadmap items are commitments of direction, not present certifications unless explicitly stated.

5. Vulnerability reporting

If you believe you have found a security issue affecting sternary.com, contact security@sternary.com. Please allow reasonable time for assessment before public disclosure.

6. Diligence materials

Qualified investors and enterprise partners may request an expanded security & architecture overview via the investor inquiry form or investor materials page.