# Strike Graph privacy rating

Hosted compliance platform that builds security programs, collects evidence and runs audits for SOC 2, ISO 27001, HIPAA, CMMC and other frameworks.

## Summary

Strike Graph scores 25 out of 100 (grade F) on the compliance automation criteria. It meets 1 of 8 criteria: TLS configuration. It partly meets no ads or data sales and independent audit. It does not meet open source, no trackers or telemetry, transparency report, tells users about requests and security headers. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B-.

- Website: https://www.strikegraph.com
- Jurisdiction: United States. Five Eyes member. Subject to the US CLOUD Act.
- Platforms: Web
- Home page trackers: Google Tag Manager, HubSpot
- Category: [Compliance automation](https://privacyratings.com/compliance-automation/)
- Grade: F (25/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | No | The privacy policy names Google Analytics and describes advertising identifiers, and the website loads HubSpot and Google Tag Manager. | https://www.strikegraph.com/privacy |
| No ads or data sales | Partial | Paid service with no ads in the product, but the privacy policy lists providing advertising to a visitor's browser or device as a use of collected data. | https://www.strikegraph.com/privacy |
| Independent audit | Partial | States SOC 2 Type 2 compliance, but no report is published. | https://www.strikegraph.com/blog/strike-graph-achieves-soc-2-type-2 |
| Transparency report | No | No transparency report is published. The privacy policy only says information may be disclosed to comply with subpoenas, warrants, court orders or government requests. | https://www.strikegraph.com/privacy |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=grc.strikegraph.com&hideResults=on |
| Security headers | No | Grade B- (65/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=grc.strikegraph.com |
| Modern web standards | Not tested yet | Not tested yet. |  |

Source: https://privacyratings.com/compliance-automation/strike-graph/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/compliance-automation/strike-graph.md