Security and Data Handling - STRASYS Global
Trust center
Security and data handling, stated plainly.
Six management software products, one person who wrote every line. This page says exactly where your data lives, who can reach it, what is logged, how you get it out, and which external assessments we do not have. Every statement was checked against the application source code.
Data in the EU (europe-west1)Apple, Google or Microsoft sign-in, no passwordsDelete your account inside the productNo ads, no tracking in the productsVerified 28 Sep 2026
Data regioneurope-west1, BelgiumEU
Sign-inApple, Google or Microsoft, no passwordsAll devices
App CheckreCAPTCHA v3 on web, Android and Windows; App Attest on iPhone and iPadOn
Team productsExecution, Culture: 6-tier rolesRBAC
Single-user productsLean, Reflections, ToolsPrivate
Account deletionInside every product, server-sideInside the product
External assessmentsNone yet, stated below
Security contactcare@strasysglobal.com
The basics
Where the data lives and who can reach it
Every statement on this page was checked against the application source code.
Where the data lives
- All six products run on Google Cloud (Firebase), europe-west1, Belgium.
- Database, storage and server functions are pinned to that region.
- Reflections voice processing and reports run on Google Vertex AI in the EU.
- The marketing site is served by Cloudflare.
How you sign in
- With an Apple, Google or Microsoft account, on every device.
- No STRASYS product stores a password.
- Firebase App Check: reCAPTCHA v3 on the web, Android and Windows; App Attest on iPhone and iPad.
- Requests that do not come from a genuine installation are refused before they reach the database.
Who can see what
- Execution and Culture: six-tier roles plus Super Admin and Admin, enforced in server-side rules.
- Leadership: one admin; extra HR accounts as administrators or read-only viewers, each with its own subscription.
- Lean, Reflections and Executive Tools are single-user; Lean can share a read-only process link for 30 days.
- Culture respondents, and Leadership evaluators and line managers, answer through links without an account.
Transport and processing
- Every STRASYS address is served over HTTPS only, enforced through HSTS.
- Each account sees only its own data, and every company is kept separate.
- Reflections audio is processed in the EU region and deleted right after; Reflections keeps no copy of the recording.
- Executive Tools processes camera images and microphone sound on the device; they are never sent to our servers.
Per product
What each product logs, exports and lets you delete
- Account deletion is inside every product, in the account menu (Delete Account & Data); in Reflections and Executive Tools also in Settings.
- It removes the account and its data server-side; consent records are kept as legal proof, and security and billing records expire on their own.
- Culture and Execution: a team member sends a deletion request, and an administrator approves it. If the account is the company's only member, the company and all its data are deleted with it.
- Leadership: the organization's employee records are deleted separately with Delete organization.
- A store subscription that is still set to renew is cancelled first; then the account can be deleted right away.
UsersAudit and immutabilityExport
01Execution
Users
- Multi-user: Super Admin and Admin
- Six business tiers: CEO, C-Suite, EVP, VP, Director, Manager
Audit and immutability
- Immutable audit trail of every change
- Quarterly data locked by country approval owners
Export
- Export My Data
- CSV
02Leadership
Users
- Single admin, two roles
- Additional HR accounts, each with its own subscription
Audit and immutability
- Closed assessment cycles kept as immutable snapshots
Export
- Export My Data
- Export Center reports
- Share by link
03Culture
Users
- Multi-user: Super Admin and Admin
- Six business tiers
Audit and immutability
- Audit trail of every key action (60+ action types)
- Closed cycles kept as immutable snapshots
Export
- Export My Data
- CSV (Trends, Audit Trail)
04Lean
Users
- Single user
Audit and immutability
- Calculations run server-side and cannot be edited by hand
Export
- Export My Data
05Reflections
Users
- Single user
Audit and immutability
- A recorded decision cannot be edited
- A deletion needs a written reason and goes to a separate audit collection
Export
- Export My Data (JSON)
06Executive Tools
Users
- Single user
- An account only for the Executive tier
Audit and immutability
- The free plan keeps data on the device only
Export
- Export My Data for every signed-in user
- PDF and image export in the Executive tier
Deletion: inside every product, the same steps on iPhone, Android, Windows and the web. Export gives you your own data in an open format.
Money and ads
Payments and tracking
Payments
- Bought through Google Play Billing on Android or Apple In-App Purchase on iPhone and iPad.
- The browser and Windows versions have no purchase; a plan from either store unlocks every device with the same account.
- Card numbers never reach STRASYS; we receive only a purchase token or a transaction identifier.
- Refunds are handled by the store; see the Policies page.
No ads and no tracking in the products
- No advertising, and no advertising or tracking SDK.
- Usage analytics (Google Analytics for Firebase) runs only if you allow it, and can be switched off in the account menu.
- It is not used for advertising and not combined with data from other companies.
- The marketing site uses analytics only if you accept it in the cookie banner.
Sub-processors
Who else touches the data
ProviderUsed forWhere
Google Cloud / Firebase
Used for
- Database, storage, server functions and sign-in for all six products
- Reflections push notifications on the web and Android
Where
europe-west1, BelgiumGoogle Vertex AI
Used for
- Reflections: structuring voice notes (audio processed in the EU, deleted right after)
- Reports generated from your own decision text
Where
EU regionGoogle Play
Used for
- Android distribution
- Subscription billing
Where
GoogleApple
Used for
- iPhone distribution (also runs on iPad)
- In-App Purchase billing
- Sign in with Apple; Reflections push notifications
Where
AppleMicrosoft Store
Used for
- Windows distribution
- No billing: no purchase inside the Windows products
Where
MicrosoftApple, Google and Microsoft identity
Used for
- Sign-in: name, e-mail and an identifier
- Never a password
Where
ProviderGoogle Analytics for Firebase
Used for
- Optional usage analytics in the products
- Only with consent
Where
GoogleGoogle Maps Platform
Used for
- Map tiles in Culture and Execution
- Your IP address reaches Google when the map loads
Where
GoogleOutside services (Open-Meteo, Frankfurter, Binance, Gold API, Nager.Date)
Used for
- Executive Tools only, called from your device when you use a live-data tool
- Weather, exchange rates, crypto and metal prices, public holidays
- Each service receives your IP address and the request, never your account data
Where
ProviderCloudflare
Used for
- Marketing site hosting and security headers
- The consent record endpoint
Where
Global edgeGoogle Analytics and Tag Manager
Used for
- Marketing site only
- After consent
Where
GoogleAidbase
Used for
- Support chat widget on the marketing site
Where
ProviderApart from these services and the billing notifications Google Play and Apple send about subscriptions, the products have no other integration, webhook or public API.
Honest gaps
What we do not have
You will meet vendors who imply these. We would rather tell you.
- 01No ISO 27001 or SOC 2 reportThe controls above exist; no external auditor has assessed them.
- 02No independent penetration test reportSecurity rules, App Check and rate limiting are in place; a third party has not attacked them on paper.
- 03No contractual SLAProduct subscriptions carry no SLA or service credits. We target 99.9% monthly availability, which also depends on Google Cloud / Firebase in the EU.
- 04One personSTRASYS is a sole proprietorship. That is why export is built into every product: your data is never locked to a person.
- 05No bug bountyA vulnerability report to care@strasysglobal.com is read by the person who wrote the code.
Legal and the site itself
Compliance and site hardening
The Privacy Policy, Turkish KVKK notice, cookie policy and terms are on the Policies page; they cover GDPR (EU/EEA), KVKK (Türkiye) and PDPA (Singapore, Malaysia) rights: access, export, correction, erasure. Every product supports erasure directly in the product. The headers the marketing site sends on every response:
- Strict-Transport-Security
- max-age=63072000; includeSubDomains; preload
- Content-Security-Policy
- default-src 'self'; object-src 'none'; frame-ancestors 'self'; form-action 'self'; upgrade-insecure-requests (allow-lists limited to the providers above)
- X-Frame-Options
- SAMEORIGIN
- X-Content-Type-Options
- nosniff
- Referrer-Policy
- strict-origin-when-cross-origin
- Cross-Origin-Opener-Policy
- same-origin
- Permissions-Policy
- camera=(), microphone=(), geolocation=(), payment=(), usb=(), interest-cohort=(), browsing-topics=() and others
Questions about anything on this page, or a security concern: care@strasysglobal.com. For contracts that need a data processing agreement, ask on the same address. Verified against application source code on 28 September 2026.