Working prototype · built on AWS

Version control that can prove every change.

Strata is serverless version control on Amazon S3, built for banks, insurers and other regulated organizations. Teams version code and docs from the bottom up. Rules, CI templates, AI prompts and agent skills cascade from the top down. Every write lands in a tamper-evident ledger.

See the controls What works today
Organization ci/** locked Business unit lint override Team AGENTS.md append Repository your code

The problem

Git was built for emailing kernel patches. Enterprises now keep their rules in it.

Large companies store code, infrastructure, policies, and now the prompts and skills that steer AI coding agents, all in a tool that has no idea who you are or what your auditor needs.

Servers to run

Hosting Git at scale means fleets to patch, capacity to plan, and monorepos that slow to a crawl.

Rules that don't spread

Getting a new secure-coding rule into 20,000 repositories means 20,000 pull requests that teams can ignore.

Audit trails rebuilt by hand

Compliance teams reconstruct evidence from logs that were never meant to be evidence.

Layers

Bottom-up for work. Top-down for rules.

A Layer is a repository meant to be inherited, not forked: CI templates, lint rules, a secure-coding prompt, an AGENTS.md, the MCP servers agents may call. It cascades from the organization to every repository that extends it, and each path says how lower levels may change it.

org-rulesplatform & security
payments-rulesbusiness unit
cards-teamteam
cards-apistores only its own files
locked

Lower levels cannot change it. The API rejects any push that touches it.

override

Lower levels may replace it, like a default formatter config.

append

Lower levels add their own lines, which survive every pull.

# platform team publishes the org baseline
$ strata repo create org-rules --layer
$ cat strata.layer.json
{"rules":[{"path":"ci/**","mode":"locked"},
          {"path":"AGENTS.md","mode":"append"}]}
$ strata push -m "OPS-1 org baseline"

# any team, anywhere in the company
$ strata repo create cards-api --extends org-rules
$ strata clone cards-api && cd cards-api
# ci/ and AGENTS.md arrive from org-rules
$ echo "- PAN tokens only" >> AGENTS.md
$ strata push -m "CARD-1 skeleton"

$ strata layers fleet org-rules
cards-api  payments-api  ledger-svc  …

Governance

Controls an auditor can check, not just a process to trust.

Each control is enforced in the write path, in the same database transaction as the change it governs. There is no separate audit job that can fall behind or be switched off quietly.

Tamper-evident ledger

Every write appends a hash-chained record, archived to S3 under Object Lock. Anyone with read access can run strata audit --verify.

Policy as code

Permissions are Cedar policies, versioned and reviewed in a Strata repo like any other change. Groups come from your identity provider. Fail-closed until the first policy lands.

Four-eyes approvals

An approval is bound to one exact revision; amending voids it. Authors never count, administrators included. The promotion record lists who approved.

Work tracking built in

Every change carries work items, labels and attributes. PAY-42 in a message links itself. Find every change for a ticket across all repositories.

Write-once storage

Content-addressed objects in S3, checked by S3 on upload and never overwritten. Branch moves are compare-and-swap, so concurrent pushes cannot corrupt history.

Events you can't lose

Events are published from the ledger, not alongside it. Jira gets a remote link for each change; your SIEM can subscribe to the same stream.

Break-glass

No standing admin access. No way to lock everyone out.

Once policies exist, administrators are bound by them like everyone else. In an emergency, they open a time-boxed grant instead. Grants are checked outside the policy engine, so even a broken policy push can be fixed.

  1. Activate with a reason and a ticketNamed repositories, at most 4 hours, and only after an MFA sign-in in the last 15 minutes.
  2. Every action is taggedEach write under the grant is marked in its repository's ledger and indexed under the grant. Activation pages the alarm topic.
  3. Another admin reviews itNever the holder, and only after the grant ends. A review still open 24 hours later raises an alarm.
$ strata breakglass start \
    --reason "payments down, hotfix needed" \
    --work-item INC-42 --repo payments --for 1h
break-glass bg-20261031T0912Z-4c1e active until 10:12AM on payments

$ strata push -m "INC-42 hotfix"
$ strata breakglass end

# the next morning, a second admin
$ strata breakglass list --open
$ strata breakglass show bg-20261031T0912Z-4c1e
1 actions under this grant:
  payments  ChangeCreated  INC-42 hotfix
$ strata breakglass review bg-20261031T0912Z-4c1e \
    --outcome accepted --note "diff matches INC-42"

Architecture

Nothing to patch. An idle repository costs only its storage.

Every component is a managed AWS service, deployed into your own AWS account. There is no Strata-hosted service that holds your code.

Cognito / your IdP MFA, groups CLI · console · agents people and AI alike API Gateway JWT on every route API Lambda (Go) Cedar check before data S3 data content-addressed, write-once DynamoDB index refs, changes, audit chain Ledger Lambda from the table stream S3 audit archive Object Lock EventBridge ChangeCreated, BreakGlass… Jira · SIEM · alarms retries and a DLQ stream

One transaction

A change, its ref move and its audit record commit together in DynamoDB, or not at all.

Your keys

Data, index and audit each use their own customer-managed KMS key, rotated yearly and retained on delete.

Alarms on the auditors' worries

Ledger lag, dead-letter queues, edits to the ledger function itself, and every break-glass activation.

Cost model

~$0.58per engineer per month, estimated
ComponentPer month
S3 storage, 2 TB Standard~$47
S3 requests~$60
Lambda and API Gateway~$150
DynamoDB on demand~$120
CloudFront egress for checkouts~$200
Total~$577

Estimate at AWS list prices for 1,000 engineers, 2 TB of history and 5 million writes a month. People and agents who only read add no per-seat cost.

Compliance

Designed around what a bank's auditor asks for.

Strata is designed to support these requirements. It is not certified against any of them, and each organization stays responsible for its own compliance.

RequirementHow Strata addresses it
DORA Art. 9: access control and change managementCedar policy on every request, four-eyes approvals on protected branches, no standing admin access
DORA Art. 9(4)(c), SOX emergency changesTime-boxed break-glass with a ticket, full tagging and an independent review
SOX change management, RTS 2024/1774 Art. 17Approvals bound to a revision; work item and fast-forward required on main
SOC 2 CC7, ISO 27001 loggingHash-chained ledger of every write, archived under S3 Object Lock, verifiable by anyone with read access
DORA Art. 28: concentration and third-party riskRuns in your own AWS account; no extra hosted provider holds your code

Build status

A working prototype, honestly labelled.

Strata runs end to end on AWS today, with an integration suite that exercises the real S3 buckets and DynamoDB table. Here is what is built, and what is still ahead.

Working

  • Content-addressed, write-once storage on S3
  • Atomic refs, stable change IDs, amend
  • strata pull with three-way merge
  • Layers: locked, override, append
  • Cedar policies, fail-closed bootstrap
  • Four-eyes approvals
  • Break-glass with review and alarms
  • Hash-chained ledger under Object Lock
  • Work items, labels, Jira links, search
  • Web console and strata CLI

Partly there

  • Large files: whole objects up to 5 GB, no chunking yet
  • Wave rollouts: canary refs, no automatic waves
  • Fleet view: who inherits, not which revision
  • Keys: customer-managed, not yet customer-supplied
  • Guardrails: locked files, no secret scanning yet
  • Agent identities: no scoped short-lived credentials yet