Security
Your records are your competitive history — production, pricing, people, and compliance. STRATA treats them accordingly.
Every row belongs to exactly one tenant, and the data layer refuses to serve it to anyone else. Isolation is tested cross-tenant on every release.
14 roles, per-user flags, and column security. Sensitive columns — pay rates, margins — are stripped below the application for roles without the flag.
The same rule is enforced at the session, the policy layer, and the data layer. A bug in one layer is caught by the next.
Every write is recorded — who, what, when, from where — to a trail that can’t be edited, including by us.
Credentials and secrets are encrypted at rest and in transit, kiosk PINs are hashed, and sessions are signed and short-lived.
When support needs access to your tenant, that access is granted, scoped, logged, and visible to you — like every other actor in the system.
The audit trail
The same trail backs an MSHA defense, a payroll question, and a support ticket.
| When | Actor | Action | Record |
|---|---|---|---|
| 22 Jul 14:52:08 | R. Delgado · Maint. supervisor | Escalated defect to critical | DEF-2026-0142 |
| 22 Jul 14:38:11 | System · weather policy | Suspended outdoor work — Plant 12 | WX-2026-0492 |
| 22 Jul 13:58:40 | L. Mendoza · Supervisor | Submitted inspection — pass, 0 findings | INS-2026-0139 |
| 22 Jul 11:02:26 | STRATA support · ticket 4811 | Read-only session opened, scoped, expired 11:31 | SUP-4811 |
| 21 Jul 16:44:03 | M. Okafor · Owner | Changed flag: C. Nguyen → can close defects | USR-0027 |
Data handling
Compliance records are retained on MSHA schedules, exportable at any time, and never silently altered. Deleting a record leaves a tombstone in the trail.
Workforce data is minimized: what payroll and MSHA require, nothing speculative. Kiosk photos serve the badge, not surveillance.
Your data is yours — export the binder, the ledger, and the trail in open formats whenever you ask. Leaving is not a hostage negotiation.
STRATA is built security-first and runs on enterprise cloud infrastructure with encryption at rest and in transit. Formal attestations are on the roadmap; we’ll publish them when they’re earned, and we won’t claim them before. In the meantime, our architecture documentation is available under NDA to evaluating customers.