Data posture
Who is responsible for your data
Your firm is the Controller of the personal data you bring to Stella. Strike Capital, Inc. is the Processor: we process that data only on your documented instructions — the agreement, the data processing addendum, and your use of the service.
What we process
Whose data:
- Customer’s users
- Deal parties (founders, employees, advisors) referenced in Customer Content
What kinds of personal data:
- Account identifiers (name, email, organization)
- Session tokens
- Any Personal Data the Customer chooses to upload as Customer Content
Where it lives, and for how long
We will publish a data map that lists each class of data with where it is stored, which sub-processor handles it, and how long it is kept. That map is not published yet. Until it is, the one retention commitment is this: when your agreement ends, or when you ask in writing, we delete or return your personal data within 30 days, unless the law requires us to keep it.
Sub-processors
These companies process data on our behalf. None of their agreements is signed yet: every company Stella uses today is marked Counsel review, which means its agreement is still with counsel. Not connected means Stella has code for it, but production cannot reach it today. GitHub and Linear only see a customer identifier when it appears in a support ticket, and counsel is still deciding whether they belong on this list. Counsel’s last draft of this list is dated May 11, 2026 and does not yet cover every vendor listed here. You get at least 30 days’ notice before a new sub-processor handles your personal data.
| Sub-processor | Purpose | Data accessed | Region | Status |
|---|---|---|---|---|
| Clerk | Sign-in, identity and sessions | Account identifiers, email, session tokens | US (multi-region) | Counsel review |
| Render | Hosting, databases and file storage for Stella | All customer content stored at rest, plus operational logs | US (Oregon) | Counsel review |
| Pinecone | Search index for deal documents and the firm knowledge base, including turning text into search vectors and ranking results | The text of document passages, the facts and names drawn from them, and the questions you search with | US (AWS) | Counsel review |
| OpenAI | Language models for chat, research and drafting; embeddings; backup transcription | Prompts (may include deal context excerpts), answers, embeddings; recordings when the main transcription service fails | US | Counsel review |
| Anthropic | Claude models for review and synthesis, and as a backup model | Prompts (may include deal context excerpts), answers | US | Counsel review |
| Exa | Web search and page reading for research | Company names, short research questions, web addresses to read | Not confirmed | Counsel review |
| Brave | Web and news search for research | Company names and short research questions | Not confirmed | Counsel review |
| Parallel | Web search, longer research tasks and page reading | Company names, short research questions, web addresses to read | Not confirmed | Counsel review |
| Firecrawl | Web search and reading public web pages for research | Short search queries and web addresses to read | Not confirmed | Counsel review |
| Browserbase | A remote browser for reading web pages | The web addresses it visits and the pages it renders, including data-room links you share | Not confirmed | Counsel review |
| Google (icon service) | Icons for companies and for the sites Stella cites | The website address of a company, or of a site Stella cites in chat, when that site has no icon of its own | Not confirmed | Counsel review |
| ElevenLabs | Turns recordings and dictation into text | The sound from audio and video files you upload, and your voice when you dictate into the composer | Not confirmed | Counsel review |
| E2B | An isolated computer where Stella runs calculations and works on files | The files and figures that work needs | Not confirmed | Counsel review |
| Nango | Secure sign-in and pass-through for the sources your firm connects (Granola, Gmail, Google Drive, Calendar, Notion) | Sign-in tokens; the notes, messages, files and events Stella reads through it; the searches Stella runs there | Not confirmed | Counsel review |
| LangSmith | Tracing, so we can see how Stella worked through a request | Which model ran, timings and cost; tool inputs and outputs with long text masked, so short text (up to 32 characters, such as a company name), every number and web addresses can appear; the comments analysts type with a thumbs-up or thumbs-down | Not confirmed | Counsel review |
| Langfuse | A second tracing service | Step records (which model ran, timings and cost); tool inputs and outputs with long text masked, so short text (up to 32 characters, such as a company name), every number and web addresses can appear; the comments analysts type with a thumbs-up or thumbs-down | Not confirmed | Counsel review |
| Sentry | Error tracking and performance monitoring | Error reports and request details with personal data scrubbed; recordings of some web sessions with all text masked; page addresses, which can contain deal names | US | Counsel review |
| GitHub | Source control and incident tracking | Customer identifiers may appear in support tickets and reproduction steps | US | Counsel review |
| Linear | Issue tracking | Customer identifiers may appear in support tickets | US | Counsel review |
| xAI | A model some research helpers could run on | Would receive short research questions about public companies | Not confirmed | Not connected |
| Jina | Reading a public web page when the other readers fail | Would receive web addresses only | Not confirmed | Not connected |
| Reducto | Reading the layout and text of uploaded documents | Would receive whole uploaded documents | Not confirmed | Not connected |
| PostHog | Product analytics for the web app | Would receive page events, with addresses reduced to page types and deal names hashed | Not confirmed | Not connected |
Public records Stella looks things up in
Stella looks things up in these sources of public records. None of them processes data on our behalf, so there is no processing agreement for counsel to review. OpenSanctions is a company that sells access to its data; it is not connected today.
| Public record | What Stella sends | Status |
|---|---|---|
| SEC EDGAR | Company names and search terms, to find filings | In use |
| CourtListener | The names of the companies and of the people being researched, to find court records | In use |
| OFAC SDN list | Nothing about your deals: Stella downloads the whole US sanctions list and checks names on its own side | In use |
| Internet Archive Wayback | A company’s website address and page paths, to see earlier versions of its site | In use |
| Companies House | Would receive names of UK companies, to find their filings and officers | Not connected |
| OpenSanctions | Would receive the names being screened against sanctions lists | Not connected |
Your firm’s own tools
When your firm connects them, Stella works with your own accounts in these tools. Those companies hold that data under your firm’s own agreement with them.
- Slack. Stella posts its answers, save confirmations and a weekly digest that names deals into your workspace.
- Box. Stella reads the files in the folders you connect.
- Notion. Stella reads the pages you connect and sends its searches there.
- Google. Stella reads Gmail, Drive and Calendar through Nango and sends its searches there.
- Granola. Stella reads your meeting notes and transcripts through Nango.
- Affinity. Stella reads your lists. Updating a deal’s status there is switched off.
How we protect it
We maintain technical and organisational measures appropriate to the risk, including:
- Encryption in transit (TLS 1.2+)
- Encryption at rest
- Role-based access controls
- Audit logging
- Vulnerability management
- Incident response
The full inventory of controls is still being written with counsel. This list is not a completed audit.
Breaches, transfers, your rights, audits
- If your personal data is breached, we tell you without undue delay, and within 72 hours of becoming aware, with the information GDPR Article 33(3) requires.
- Data transferred from the EEA, the UK or Switzerland to a country without an adequacy decision is covered by the EU Standard Contractual Clauses (Module Two) and the UK Addendum. Their modules and annexes are still being finalised with counsel.
- For requests from the people your data is about, we help — through the controls in Stella and at privacy@strikecapital.com.
- Once a year, on reasonable written notice, you may ask for the information that shows we meet the addendum. Stella is not SOC 2 certified, and SOC 2 or ISO work is on a longer horizon.
Signed terms
Our signed privacy notice, terms of service and DPA annexes are being finalized. Email privacy@strikecapital.com for the current draft.