Strapi Cloud: Trust page changed

Trust / securityChanged (not classified) (rule)Changed 2026-10-28 08:57 UTCtrust.strapi.io

Summary

Strapi Cloud’s trust page changed its displayed security controls, adding production application access restrictions, employee background checks and contractor confidentiality agreements while removing mentions of penetration testing, encryption-key access restrictions and data-retention/deletion procedures. These edits change the assurances visible to customers, but do not establish whether the underlying practices changed.

Machine-written from the diff below (Sol; type: other). Check the diff before relying on it.

What changed

~~Struck in red~~ is what Strapi Cloud removed; blue is what they added. Muted text is unchanged context.

Changed#1

…all Infrastructure security Unique production database authentication enforced ~~Encryption key access restricted Unique account authentication enforced~~ View ‹count› more Infrastructure security controls Organizational security…

…all Infrastructure security Unique production database authentication enforced Unique account authentication enforced Production application access restricted View ‹count› more Infrastructure security controls Organizational security…

Changed#2

…View ‹count› more Infrastructure security controls Organizational security ~~Asset disposal procedures utilized Production inventory maintained Portable media encrypted~~ View ‹count› more Organizational security controls Product security…

…View ‹count› more Infrastructure security controls Organizational security Production inventory maintained Employee background checks performed Confidentiality Agreement acknowledged by contractors View ‹count› more Organizational security controls Product security…

Removed#3

…Product security Data encryption utilized Control self-assessments conducted ~~Penetration testing performed View ‹count› more Product security controls~~ Internal security procedures Continuity and Disaster Recovery plans…

…Product security Data encryption utilized Control self-assessments conducted removed Internal security procedures Continuity and Disaster Recovery plans…

Removed#4

…View ‹count› more Internal security procedures controls Data ~~and privacy Data retention procedures established Customer data deleted upon leaving Data classification policy established~~ Data collected Customer personally identifiable information Employee personally…

…View ‹count› more Internal security procedures controls Data removed Data collected Customer personally identifiable information Employee personally…

Compared with the previous archived version (#8903 to #9690). Text is normalized before comparing: dates, counters and tokens show as ‹date›, ‹count›, ‹tok›, and noise-only edits are hidden. Rewindex shows changed passages with a few words of context, not a copy of the page. View the live page (opens in new tab).

Archive proof

Rewindex commits each page capture it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

Oct 27
Before captured 08:59 UTC
In the 2026-10-27 checkpoint, timestamped by DigiCert and FreeTSA on Oct 28, 00:41 UTC. Record hash da330b7d5ed53e26…
Download proof
Oct 28
After captured 08:57 UTC
In the 2026-10-28 checkpoint, timestamped by FreeTSA and DigiCert on Oct 29, 00:43 UTC. Record hash 7d9602c70d003c1a…
Download proof

History of this page

TodayThursday, November 5Thu, Nov 5

1 page change

Content changed
08:58Page change
Trust pagechanged
Strapi Cloud’s trust page added listings for restricted encryption-key access, asset disposal, portable-media encryption, penetration testing, and data retention, deletion and classification controls. Listings for unique production database authentication, employee background checks and contractor Code of Conduct acknowledgment disappeared; the page changes do not establish whether those underlying controls were discontinued.

Friday, October 30

1 page change

Content changed
08:57Page change
Trust pagechanged
Strapi Cloud’s trust page replaced “Confidentiality Agreement” with “Code of Conduct” in the statement about contractor acknowledgment. This is a wording change; the evidence does not establish a change to contractual obligations or security practices.

Wednesday, October 28

1 page change

Content changed
08:57Page change
Trust pagechangedthis change
Strapi Cloud’s trust page changed its displayed security controls, adding production application access restrictions, employee background checks and contractor confidentiality agreements while removing mentions of penetration testing, encryption-key access restrictions and data-retention/deletion procedures. These edits change the assurances visible to customers, but do not establish whether the underlying practices changed.

Tuesday, October 27

1 page change

Content changed
08:59Page change
Trust pagechanged
Strapi Cloud’s Trust page added “Unique production database authentication enforced” and removed “Production application access restricted” from its listed infrastructure security controls. This changes the published security information customers can review; the evidence does not establish whether the underlying controls changed.

Cite this

Trust page changed on Strapi Cloud’s Trust page, changed 2026-10-28 08:57 UTC (change 2 of 4).

Title: Trust page changed
Vendor: Strapi Cloud
Date: 2026-10-28 08:57 UTC
URL: https://rewindex.com/change/p9690

All Strapi Cloud changes Strapi Cloud profile Markdown JSON