{
  "slug": "strike-graph",
  "category": "compliance-automation",
  "name": "Strike Graph",
  "description": "Hosted compliance platform that builds security programs, collects evidence and runs audits for SOC 2, ISO 27001, HIPAA, CMMC and other frameworks.",
  "website": "https://www.strikegraph.com",
  "license": null,
  "platforms": [
    "web"
  ],
  "jurisdiction": {
    "code": "US",
    "name": "United States",
    "eyes": "Five Eyes",
    "eu": false,
    "gdpr": false,
    "cloud_act": "provider"
  },
  "pick": false,
  "pick_reason": null,
  "disclosure": null,
  "grade": "F",
  "score": 25,
  "coverage": 100,
  "summary": "Strike Graph scores 25 out of 100 (grade F) on the compliance automation criteria. It meets 1 of 8 criteria: TLS configuration. It partly meets no ads or data sales and independent audit. It does not meet open source, no trackers or telemetry, transparency report, tells users about requests and security headers. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B-.",
  "url": "https://privacyratings.com/compliance-automation/strike-graph/",
  "markdown": "https://privacyratings.com/compliance-automation/strike-graph/index.md",
  "answers": {
    "open_source": {
      "title": "Open source",
      "weight": 3,
      "answer": "no",
      "evidence": null,
      "note": "Closed source."
    },
    "no_trackers": {
      "title": "No trackers or telemetry",
      "weight": 3,
      "answer": "no",
      "evidence": "https://www.strikegraph.com/privacy",
      "note": "The privacy policy names Google Analytics and describes advertising identifiers, and the website loads HubSpot and Google Tag Manager."
    },
    "no_ads": {
      "title": "No ads or data sales",
      "weight": 2,
      "answer": "partial",
      "evidence": "https://www.strikegraph.com/privacy",
      "note": "Paid service with no ads in the product, but the privacy policy lists providing advertising to a visitor's browser or device as a use of collected data."
    },
    "independent_audit": {
      "title": "Independent audit",
      "weight": 2,
      "answer": "partial",
      "evidence": "https://www.strikegraph.com/blog/strike-graph-achieves-soc-2-type-2",
      "note": "States SOC 2 Type 2 compliance, but no report is published."
    },
    "transparency_report": {
      "title": "Transparency report",
      "weight": 2,
      "answer": "no",
      "evidence": "https://www.strikegraph.com/privacy",
      "note": "No transparency report is published. The privacy policy only says information may be disclosed to comply with subpoenas, warrants, court orders or government requests."
    },
    "user_notice": {
      "title": "Tells users about requests",
      "weight": 1,
      "answer": "no",
      "evidence": null,
      "note": "No published policy on notifying users about data requests."
    },
    "tls": {
      "title": "TLS configuration",
      "weight": 2,
      "answer": "yes",
      "evidence": "https://www.ssllabs.com/ssltest/analyze.html?d=grc.strikegraph.com&hideResults=on",
      "note": "Grade A+"
    },
    "security_headers": {
      "title": "Security headers",
      "weight": 1,
      "answer": "no",
      "evidence": "https://developer.mozilla.org/en-US/observatory/analyze?host=grc.strikegraph.com",
      "note": "Grade B- (65/100+)"
    },
    "web_standards": {
      "title": "Modern web standards",
      "weight": 1,
      "answer": "pending",
      "evidence": null,
      "note": "Not tested yet."
    }
  },
  "tests": {
    "ssllabs": "A+",
    "observatory": "B-",
    "internetnl_web": null,
    "internetnl_mail": null,
    "trackers": [
      {
        "name": "Google Tag Manager",
        "host": "www.googletagmanager.com",
        "effect": "no"
      },
      {
        "name": "HubSpot",
        "host": "js-eu1.hsforms.net",
        "effect": "no"
      }
    ],
    "tested_at": "2026-10-01T11:02:18.021Z"
  },
  "last_modified": "2026-10-01T11:14:42Z"
}