Document integration & ingestion policy

1. Purpose and scope

• Covers every document StratosOpx receives on a customer's behalf: purchase orders, change orders, order acknowledgements, and RFP or bid packages.
• Covers every ERP connection StratosOpx uses to read customer data or write approved records.
• Applies to StratosOpx staff, contractors, subprocessors and every AI agent operating on the platform.
• EDI transactions are out of scope. Orders that already arrive by EDI keep their existing path; StratosOpx does not replace or alter them.

2. Authorized ingestion channels

• Documents are accepted only through channels the customer has authorized in writing: a dedicated per-tenant inbound address, the web upload, the ingestion API, or an SFTP drop folder.
• Each tenant has its own inbound address and storage. Documents are tagged to the tenant at receipt and never processed outside it.
• Inbound email must pass SPF, DKIM or DMARC alignment. Mail that fails is quarantined, not processed.
• Senders must be on the customer's trading-partner allowlist. Mail from other senders is quarantined until the customer releases it or adds the sender.
• API and SFTP access uses per-tenant credentials stored in a managed vault and rotated at least every 90 days.

3. Accepted formats and limits

• Maximum 25 MB per file, 40 MB per email and 20 attachments per email.
• Orders: up to 50 pages per document.
• Bid packages: up to 150 pages included per analysis and 400 pages maximum. Extra pages are billed per the customer's plan (Bid Desk Pro: included up to 400 pages).
• Executable and script files (.exe, .dll, .bat, .cmd, .ps1, .sh, .js, .vbs, .jar, .msi, .scr, .iso, .7z, .rar) are rejected.
• Password-protected files are quarantined. StratosOpx never asks for document passwords by email.
• Macros, scripts and embedded objects are never executed. Links inside documents are never followed.

4. Security screening

• Every file is malware-scanned before parsing. Files with a detection are rejected; files whose scan has not completed are held.
• Document content is treated as untrusted data. Text inside a document is never treated as an instruction to an agent, whatever it says.
• Extraction agents have read-only tools. They cannot write to an ERP, send email or call external services.
• Possible payment-card numbers are detected and redacted before storage, and the document is held for review.

5. Classification, deduplication and billing

• Each document is classified (new order, change order, bid package, other). Documents classified as other are not processed further and not billed.
• Duplicates are detected by file hash and by customer plus PO number. Duplicates are rejected and not billed.
• A change order is linked to the open order it revises and billed as one order.
• Low-confidence extractions, SKU matches and classifications always go to a person for review.

6. ERP integration and write controls

• StratosOpx connects through a dedicated integration user with the narrowest role that supports the authorized actions. Administrator credentials are never accepted.
• Reads (items, prices, inventory, open orders, credit) are Tier 1 actions. Sandbox drafts are Tier 2. Creating or updating production orders is Tier 3 and requires a named approver per order unless an auto-post policy has been authorized.
• Deleting records, bulk edits, and changes to prices, credit limits or customer master data are Tier 4 and blocked.
• Every write goes through the execution policy service. Approval binds to the exact payload; any change needs a new approval.
• Writes carry an idempotency key so a retry cannot create a second order. The resulting record is read back and verified, not just the API response.
• New connectors go live in a sandbox or test company first, and are enabled in production only after the launch acceptance criteria are met.
• Customers can stop all writes at any time with the emergency stop. Reads and drafting continue.

7. Data handling, retention and deletion

• Data is encrypted in transit and at rest and isolated per tenant, with tenant checks at every API, retrieval and tool boundary.
• Source documents are kept for 90 days by default (configurable by contract), then deleted. Quarantined documents are deleted after 30 days if not released.
• Extracted records, approvals and audit logs are kept for the subscription term. Longer log retention is available on the Scale plan.
• On termination, customer data is available for export and then deleted within 30 days, except where law requires otherwise.
• Personal data is limited to what orders and bids contain (for example buyer names and contact details) and is processed only to perform the service.
• Regulated data (health information, payment-card data beyond redaction, controlled technical data) is not accepted without a separate assessment and agreement.

Source documents

90 days

Unreleased quarantine

30 days

Deletion after termination

Within 30 days

8. AI models and subprocessors

• Customer documents are not used to train general-purpose AI models.
• Customer-specific tuning (for example SKU aliases and validation rules) stays within that customer's tenant.
• Model, OCR and hosting providers are listed in the subprocessor register, which customers can request at any time.

9. Exceptions and incidents

• Documents that cannot be parsed go to the review queue with the reason. They are never silently dropped.
• Suspected malicious documents are quarantined and the customer is notified.
• Security incidents are handled under the StratosOpx incident response plan, including evidence preservation and customer notification as the contract and law require.

10. Customer responsibilities

• Authorize ingestion channels and maintain the trading-partner allowlist.
• Provide and maintain a least-privilege ERP integration user, and tell StratosOpx before ERP upgrades or configuration changes.
• Name the approvers for Tier 3 actions and keep that list current.
• Do not send regulated data unless a separate agreement covers it.

11. Ownership and review

• Owner: AI / agent lead, with the security owner. Approved by the founder.
• Reviewed quarterly, and whenever a new connector, document type or subprocessor is added.
• This draft is a business-planning document and must be reviewed by qualified legal and security advisers before it is published or incorporated into customer contracts.