Data Processing Addendum

This DPA describes how Stratum processes personal data on your behalf and lists our sub-processors.

Roles

For data you submit, you are the controller and Stratum is the processor. We process only on your documented instructions to provide the service.

Security measures

• Encryption in transit (TLS) and at rest.
• Bitfinex API secrets encrypted with AES-256-GCM; never logged.
• Access controls and least-privilege internal access.

Sub-processors

• Cloud hosting provider — application + database hosting.
• Transactional email provider — sends account email (verification, alerts, receipts).

We notify customers of new sub-processors before they begin processing.

Data subject requests

We assist you in responding to access, correction, and deletion requests. Contact [email protected].

Sub-processor breach

We notify affected customers without undue delay after becoming aware of a personal data breach.