Direct answers
Does it require EVE SSO?Yes for the authenticated FC workspace. A limited Crew View can be shared without EVE login; its capabilities are selected by the FC, the link can be revoked, and it expires.
Does it automate EVE?No. STRATA does not control the EVE client, simulate keys or clicks, or make gameplay decisions. Background workers read authorized ESI data. Fleet-write and UI actions occur only after a commander explicitly requests the supported action.
Is the source public?No. STRATA’s original source remains private during closed beta to protect the product and its security boundary. Public source availability is not claimed. Selected reviewers may be given controlled access in the future.
Has CCP approved it?No claim of CCP certification or approval is made. STRATA is an independent third-party application designed around official EVE SSO, ESI documentation, provider caching, and error-limit behavior.
What does it track?Only information needed for enabled features: the authorized character, active fleet structure and attendance, available ship and location observations, fleet movement evidence, submitted D-scans and Local lists, fleet-scoped killmail evidence, command notes, and report history.
EVE permissions requested from normal users
STRATA shows this list before sending a user to EVE Online. EVE then shows its own authorization screen, and STRATA validates the scopes actually granted on callback.
| Scope | Why it is used |
|---|
esi-fleets.read_fleet.v1
Read access | Read the active fleet, hierarchy, roster, roles, ships, and systems. |
esi-fleets.write_fleet.v1
Explicit action | Update supported fleet configuration and member positions only after an explicit commander action. |
esi-location.read_location.v1
Read access | Read the selected character’s current solar system or station. |
esi-location.read_ship_type.v1
Read access | Read the selected character’s current ship type. |
esi-location.read_online.v1
Read access | Read whether the selected character is online. |
esi-killmails.read_killmails.v1
Read access | Read the selected character’s authenticated killmail references. |
esi-universe.read_structures.v1
Read access | Resolve names for structures the selected character may access. |
esi-ui.open_window.v1
Explicit action | Open supported information windows only after an explicit click. |
esi-ui.write_waypoint.v1
Explicit action | Set a waypoint or destination only after an explicit click. |
Wallet separation: esi-wallet.read_character_wallet.v1 is not requested from ordinary members. It is held only by the designated owner-side sponsor recipient credential so the server can verify qualifying incoming donations.
Data and storage
Stored for the service to work
- EVE character ID, character name, ownership verification, corporation/alliance snapshots, granted scopes, and authorization timestamps.
- Encrypted EVE access and refresh tokens. Plaintext tokens, authorization codes, client secrets, and authorization headers are not displayed in the product or public logs.
- Fleet identity, roster and hierarchy observations, ships, systems, attendance windows, movement evidence, timeline events, reviewed killmail associations, FC notes, and versioned reports.
- Access decisions, revocations, public-link state, and bounded audit/security metadata needed to investigate changes and prevent replay.
Not requested from you
- Your EVE account password or launcher credentials.
- Control of the EVE client, unrestricted access to your computer, private messages, or arbitrary local files.
- Your character wallet. Ordinary user authorization does not include the wallet scope.
Operational history is retained so saved fleets and deterministic reports remain reproducible. Credentials can be revoked; revocation stops further provider use. Public and Crew View links are separately controlled and do not make the private FC workspace public.
Security boundary
- STRATA is a standalone service with its own identity, database, cache, sessions, permissions, and audit records.
- Tokens are encrypted at rest with a server-held key. Authorization state uses PKCE, single-use state, signed-token verification, issuer/audience validation, and scope validation.
- PostgreSQL, Redis, management interfaces, and internal service ports are not intended as public user endpoints.
- Organization authorization and report visibility are enforced server-side; hiding a control in the browser is not treated as security.
- Provider requests are server-side, identified, cached for their supported lifetime, bounded by timeouts, and expected to respect ESI error limits and retry guidance.
No beta software can honestly promise zero risk. Users should review the EVE authorization screen, grant access only to the intended character, and revoke access if anything looks wrong.
Source, AI assistance, and third-party provenance
STRATA’s current web service is a private Django and browser-based implementation developed for this project. Its workflows were informed by established EVE community tools and public documentation.
- Reviewed MIT-licensed projects include Wanderer and breport. Where source snapshots or adaptations are retained, their upstream authorship, versions, license texts, and modification records are preserved.
- zKillboard, WarBeacon, EVE Scout, and official ESI/SDE sources are treated as data providers, integrations, or behavioral research according to their available interfaces and terms. STRATA does not claim their brands or proprietary source as its own.
- Development has used substantial AI-assisted, “vibe-coded” workflows under human direction and review. The previously stated roughly 60% figure is an owner estimate, not a measured code-provenance percentage.
- AI assistance does not remove the owner’s responsibility to test, correct, document, and secure the resulting service.
Keeping STRATA’s original source private is a product-protection choice. It does not remove the obligation to preserve third-party license notices, describe permissions honestly, or correct security defects.
Brand and official status
STRATA FC Companion, its name, presentation, and official logo identify this service. Private source and brand protection are intended to prevent unofficial copies from being presented as the official STRATA product.
STRATA is not affiliated with, endorsed by, sponsored by, or an EVE Partner of CCP Games. EVE Online names, marks, imagery, and game data remain subject to CCP’s rights and policies.
Owner & Maintainer: Captain Steve Madden
Questions and responsible reporting
Ask the owner which exact scope enables a feature before authorizing it. For unexpected permissions, data exposure, account-linking behavior, or other security concerns, send an EVE Mail to Captain Steve Madden
.
Do not send access tokens, refresh tokens, authorization codes, passwords, client secrets, private Crew View links, or full request headers in Discord screenshots or public reports.
STRATAFC