How secure is our data on Flex Strata?

Committees are right to ask about security before putting a building's records into any shared system, particularly given how sensitive some of that information can be.

Access control as a security foundation

Because access is role-based and configurable page by page, the first layer of security is simply limiting who can see what — a contractor invited into a single thread has no visibility into anything else, and an owner sees only what the committee has opened up.

The audit log

Every change of consequence across the portal is recorded in an audit log, so the committee can see who did what and when — a document uploaded, a permission changed, a resolution recorded. This matters as much for accountability within the committee as it does for external security, since it removes any ambiguity about who took a particular action.

Data hosting

Data is hosted in Australia where practical, reflecting that Flex Strata is built for Australian strata schemes and their obligations.

What committees can do to help

• Use strong, unique passwords for portal accounts and enable any additional login protections offered
• Remove access promptly when someone leaves the committee, rather than leaving old accounts active
• Review who has access periodically, particularly manager and contractor access that may no longer be needed

Being realistic about claims

No system can promise to be invulnerable, and it's worth being wary of any provider — including this one — that claims otherwise. What's reasonable to expect is a considered approach to access control, a genuine audit trail, and Australian hosting where practical, which is what Flex Strata is built around.