Support Access Policy

How Stralos staff access your information

Effective date: 28 October 2026 · Version 1.0

This policy explains who at Stralos can see your company's information in Stralos, why, how we keep it separate from other companies, how we back it up, and how you can check for yourself. It sits alongside our Privacy Policy and Terms of Service.

1. Your information is yours

Your company's information in Stralos belongs to you: your projects, estimates, rates, pricing, tenders, documents and the details of your people. We only look at it when we need to help you, to run, fix or keep Stralos secure, or when the law requires it.

2. How we keep your information separate from other companies

Many companies use Stralos. These controls stop anyone in another company from seeing your information:

• Locked to your company in the database (row-level security). Your projects, estimates, rates, suppliers, documents and other company records are locked to your company inside our databases. Each time someone uses Stralos, the database itself checks which company they're signed in to and only hands back that company's records.
• One company per sign-in. When you sign in, Stralos gives you a pass for one company only, and every part of Stralos checks it. To work in another company you switch companies: Stralos first checks that you belong to that company, then gives you a new pass.
• Tested on every change. Automated tests sign in as one company and try to read another company's records, and they must be refused. They run every time we change the parts of Stralos that hold your company's records.
• Documents kept apart. Each company's files are stored in their own area, and our file storage is never open to the public internet. When you open a document, Stralos gives your browser a private link that stops working within 15 minutes.
• Contractors see only their projects. If you bring in someone from another company as a contractor, they see only the projects you add them to.
• Encrypted. Your information is encrypted while it travels between your browser and Stralos, and where it's stored.

What is shared. A few things are the same for every company and aren't anyone's private information: Stralos's standard lists (such as units of measure and standard project roles), default settings and our help content. Your own rates, suppliers, projects and documents are never shared with other companies.

3. Who at Stralos can get into your company to support you

To support you, authorised Stralos support staff can:

• sign in to your company as one of your people, if your company allows it (see below), to see what that person sees and help sort out a problem;
• User administration from admin portal:
  • change the email address one of your people signs in with;
  • add a person to your company, change their role (admin or member), or remove them;
  • set up, update or switch off a person's account or your company's account;
  • change your company's billing or discounts.

Every time they do one of these things:

• they must write down the reason first;
• it's recorded: who did it, when, who it was for and why;
• a sign-in ends after 1 hour at most.

We only do this when you ask us to (for example, to help with a support request), when we need to keep Stralos secure or fix a fault, or when the law requires it.

Each client company decides whether Stralos support may sign in as its people. A company admin can turn “Allow Stralos support to sign in to your company” on or off at any time in Settings → Support access. It is on unless an admin turns it off.

While it is off, Stralos support cannot sign in as anyone in your company, and any support sign-in already in progress is ended (its access stops within 15 minutes). Support can still help you by email.

4. You can see every support access

If you're an admin of your company, go to Settings → Support access in Stralos. It lists every time Stralos staff signed in to your company, changed one of your people's email address or access, or switched one of your people or your company off. For each one you can see:

• who at Stralos did it, and when;
• who it was for, and what they did;
• the reason they gave;
• for a sign-in, how long it lasted.

We don't hide, change or delete these records. The only exceptions are when your company's data is deleted (see our Privacy Policy), and when a person asks us to erase their personal information: then we remove their name and email address from the list.

Every change to the “Allow Stralos support to sign in to your company” setting is listed on your company's Support access page, with the date and time and the name of the admin who made it.

Even while support sign-in is off, Stralos support can still make the account changes that billing and account recovery depend on, such as correcting a person's email address or their place in your company. Each one needs a reason and is listed on your Support access page.

5. Founders who also run a construction company

Two of our founders, James Macdonald and Ben Hopewell, also work at Atlas Group Limited, a civil construction company that uses Stralos, and James is also an owner of Atlas. We want you to know that, and how we keep it separate.

What they can see. James and Ben help run Stralos as a business, so they can view general account information in our staff admin portal:

• combined, anonymous figures about how Stralos is used across all companies (for example, overall totals), which never identify your company, your people or your work;
• which companies use Stralos;
• each company's plan, subscription, number of users and seats, price, discounts and payment status;
• the names and email addresses of the people in each company, and whether each one is an admin or a member.

They can only view this information. They can't change any company's people, account, billing or discounts.

What they can never do. James and Ben can never sign in to another customer's company, change anyone's email address, access or account, or see another customer's projects, estimates, rates, pricing, tenders or documents, apart from what you send to our support email (see below). These controls make sure of it:

• Stralos blocks them. Stralos won't let them sign in as anyone in any customer's company (Atlas included), or change anyone's email address, access or account.
• View only. Our staff admin portal lets them view only the account information listed above, and won't let them change it. It doesn't show projects, estimates, rates, pricing, tenders or documents.
• No access to our live systems. They have no access to the computer systems or databases Stralos runs on.
• No way around it. They don't hold top-level admin rights over Stralos's own Google accounts, which could otherwise be used to take over another staff member's sign-in.
• A signed promise. They have signed a written undertaking to follow these rules.
• Nobody passes it on. No one at Stralos gives your information to James or Ben, whether in conversation, email, chat, screenshots, exports, shared folders or reports, apart from what you send to our support email (see below). When we discuss Stralos's business with them, we only use general or combined figures that don't identify you. They have also promised not to ask for it, and to delete and report anything they receive by mistake.
• You can check. Every support sign-in and change is recorded and shown to you in Settings → Support access.
• Atlas through Atlas accounts only. They use Stralos for Atlas only through their own Atlas accounts, like anyone else at Atlas.
• Atlas is a company like any other. The controls in section 2 keep everyone at Atlas, James and Ben included, out of your company's information, the same as any other company.

Support emails. James and Ben help answer our support email, so they can see what you send to support@stralos.co.nz. They use it only to answer your request. Please don't email your rates, pricing, tenders or documents to support. If we need to see them, other authorised Stralos support staff will look in Stralos with your permission.

No cross-use. Nobody at Stralos uses one customer's information, or passes it on to anyone, for another customer, for a business they're connected with, or for themselves.

6. Where your information stays

• Your information stays in our live system. We don't copy your real data into the systems we use to build and test Stralos unless you agree in writing.
• When our team tries out new features in the live system, they use Stralos's own company, not yours.
• Direct access to our live systems and databases is limited to the staff who need it to run Stralos and is logged.

7. Customer data backups

• Back to any moment in the last 30 days. Our databases are backed up automatically, and we can restore them to any moment in the last 30 days.
• Locked long-term copies. We also keep a locked monthly copy of our databases for 12 months and a yearly copy for 7 years. They're held in locked storage that nobody, including us, can delete or change before then.
• Earlier versions of your files. If a document is changed or deleted, we can get the earlier version back for 30 days.
• High availability. Our databases run across/in multiple data centres in Sydney at the same time, so losing one doesn't lose your information.
• Encrypted. Backups are encrypted, the same as your live information.
• Kept in Australia. Your live information and backups are kept in Australia.

Restore testing. From time to time we will perform restore testing of one of our backups. This is to confirm that our processes are working correctly. Once the restore is confirmed as successful, the restored copy is deleted.

When your data is deleted. When your company's data is deleted (see our Privacy Policy), we remove it from our live systems, including every version of your documents. Copies of the database already in backups stay until those backups expire: up to 30 days for everyday backups and up to 12 months (monthly copies) or 7 years (yearly copies) for the locked copies, which can't be deleted early.

8. If something goes wrong

If anyone gets into or uses your information in a way that breaks this policy, or tries to, we treat it as a security incident. If your information was seen or used without a proper reason, we'll tell you. Our Privacy Policy also sets out how we tell you about a privacy breach.

If you think someone has got into your information who shouldn't have, please email security@stralos.co.nz.

9. Questions

We're happy to talk about any of this. Please email our Privacy Officer, Graeme Ainsworth, at privacy@stralos.co.nz, or our support team at support@stralos.co.nz. Read more in our Privacy Policy and Terms of Service. If we change this policy, we'll post the new version at stralos.app/support-access with a new version number.