Privacy Policy

This policy describes ECNO Security Solutions’ handling of information through Stratum. The service is intended for authorized professional users, including ECNO staff, participating organizations, and approved contributors. It is not a service for student accounts, student monitoring, or building consumer profiles. Your organization’s own privacy notices and its agreement with ECNO may also apply to records it provides.

Account information may include your name, work email address, organization or department, assigned role, preferences, and identifiers used to link your approved sign-in account. Local accounts use password hashes. When you use single sign-on, your identity provider handles your password; Stratum does not receive that password.

Service content includes review requests, application and vendor details, professional contact information, questionnaire responses, notes, evidence, uploaded files, and reports. Such content may contain personal information supplied by an authorized user. Do not submit identifiable student records or unrelated personal details unless your organization has established the authority and necessity to do so.

We also process sign-in and activity records, timestamps, security and diagnostic information, and service-usage records. Hosting and security systems may process IP addresses and browser or device information. Where AI features are used, usage records may identify the user, model, processing activity, and usage or cost totals.

If Google sign-in is available and you choose it, basic identity information such as your name, email address, unique Google account identifier, and verification or organization information is used to authenticate and link your approved account. Basic profile information returned by Google may also include a profile image. Google sign-in is for authentication; it does not grant access to Gmail, Drive, Calendar, contacts, or other Google content.

Google identity information and authentication records are used only for account access, administration, and security. They are not sold, used for advertising, or used to train general-purpose AI models. Our use and transfer of Google API information follow the Google API Services User Data Policy, including its Limited Use requirements.

You can revoke Google access through your Google Account connections. Revocation does not automatically delete existing service records; contact ECNO for an account or deletion request.

We use information to authenticate users, enforce access permissions, coordinate reviews and requests, communicate service updates, produce and share authorized reports, maintain accountability, troubleshoot problems, and protect the service from misuse. We do not collect unrelated personal details for marketing, sell personal information, or create advertising profiles.

Where enabled and authorized, Sera and document-processing features may send prompts, selected files, and relevant review content to configured AI, search, and document-processing providers to extract information, retrieve evidence, and generate analysis or answers. Public-web research may send search queries to a web-search provider. Access is governed by the user’s permissions and the report or review scope. Avoid unnecessary personal information in prompts and uploads, and follow your organization’s rules for AI use.

Information is available to authorized ECNO administrators and reviewers, approved collaborators, and participating organizations according to their roles and report-publication permissions. A report may include reviewer or business-contact details where those details form part of the authorized report. Access to one account does not authorize access to every organization’s records.

Service providers process information as needed for hosting, storage, authentication, communications, and enabled AI or document-processing functions. Production hosting and storage use Microsoft Azure. Identity providers also process sign-in information under their own terms and privacy notices. ECNO may disclose information where legally required or necessary to address fraud, abuse, or security incidents. We do not provide personal information to advertising networks or data brokers.

Account and review records are stored in the service’s database; supporting documents and report files use protected file storage. Enabled retrieval features may maintain derived text or search indexes. We use access controls and technical safeguards to protect information, although no system can guarantee absolute security. Processing locations depend on the service configuration and providers; contact ECNO for the arrangements that apply to your organization.

The platform uses cookies and browser storage for sign-in, session security, interface preferences, and working features such as a chat session. These are not used for targeted advertising or tracking you across unrelated websites. Disabling necessary cookies may prevent sign-in or affect functionality. Your identity provider may set its own cookies during authentication.

Information is retained as needed to operate the service, maintain review history and accountability, meet the organization’s service arrangements, and satisfy legal or security obligations. Retention varies by record type; closing an account does not necessarily remove shared review records. Backups, audit records, or information subject to a legal retention requirement may remain after an active record is removed.

Contact ECNO or your organization’s administrator to request access to, correction of, or deletion of your personal information, or to close your account. We may need to verify your identity and coordinate with your organization. Requests are handled in accordance with applicable law and service obligations, including any records that must be preserved. Do not send your sign-in password with a request.

We update this policy when our practices change and identify the revision date above. Material changes will be communicated through the service or the organization’s service contacts. If a new use of Google information requires additional notice or consent, we will provide it before that use begins.