Security
Built to be trusted with owners’ money and data
Strata managers hold trust funds and personal information for hundreds of people. We treat that as the design constraint it is, starting at the database and working out.
Isolation enforced in the database
Every row is scoped to the organisation that owns it, and that boundary is enforced by the database itself, not just the app. A manager only sees the buildings they belong to. An owner only sees their own unit.
A full audit trail
Every create, edit, delete, and status change is recorded with who did it, when, and what changed. Nothing meaningful happens without leaving a record you can review.
Least-privilege access
Roles decide what each person can do. Assistants can read team data but cannot invite or remove people. Privileged operations are tightly scoped and never the default path.
Encrypted in transit and at rest
All traffic runs over TLS, and data is encrypted at rest by our infrastructure provider. Photos and documents live in private storage that is never publicly listable.
Australian data residency
Your data is hosted in Australia and handled in line with the Australian Privacy Principles under the Privacy Act 1988.
Scoped reads, signed links
Files are served through short-lived signed links rather than open URLs, so access follows the same permission rules as the rest of the platform.
Responsible disclosure
Found something that looks wrong? We want to hear from you. Email security@stratai.com.au and we will get back to you quickly. Please give us a reasonable window to fix an issue before disclosing it publicly.
See stratai on your own buildings
A short, no-pressure walkthrough on your portfolio. We will show you the manager and owner sides, and answer anything.