A StratMap tracker holds real income, loan balances and property addresses. Here is exactly what we do to protect it, in plain English, with nothing claimed that isn't true today.
Your data lives on servers in Sydney, including backups. Not overseas.
Encrypted while it travels to and from our servers, and encrypted while it sits in our database.
Our database enforces this at the row level: every query is scoped to your own rows. The only other access is the logged staff and partner access described in the Privacy Policy, and anyone you add to your team.
Add a code from your phone alongside your password, any time, from your account settings. Entirely your choice.
A strategist opens your tracker only when there's a reason to, most often to help you directly. Every time, it's recorded.
Not to advertisers, not to data brokers, not to anyone. We say so in the privacy policy and we mean it.
Your password is never stored as plain text, only as a one-way hash that can't be reversed, not even by us. A minimum of 12 characters is required. If you've forgotten it, a reset link is emailed to you and expires after a short window.
It's not a setting someone could accidentally leave switched off. It's enforced by the database itself, through row-level security: every query your account makes is automatically scoped to your own rows, and nothing else is reachable through the same door, regardless of what the application code asks for.
Part of what you're paying for (or using for free) is a strategist who can actually help you. That means a strategist may look at your tracker directly, either because you've asked about something specific, or because it's part of a service you're already signed up for, like preparing your six-month review. It's never casual browsing, and every time it happens, it's logged.
Sessions expire automatically after 30 days, even if you never sign out yourself. You can add two-factor authentication from your account settings at any time: once it's on, a code from an authenticator app on your phone is needed alongside your password to sign in, so a leaked or guessed password on its own isn't enough.
No system is completely secure, and we won't tell you otherwise. If a security incident affects your personal information in a way likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner, in line with the Notifiable Data Breaches scheme.
If anything here isn't clear, or you want to ask about your own data specifically, get in touch. We aim to respond within 5 business days.