Strova is headquartered in Singapore and operates across the Asia-Pacific region. Data is stored in Australia by default, with Singapore also available. Enterprise plans can specify their own residency region to meet local compliance requirements.
All database records and uploaded files are encrypted at rest using AES-256, managed by Google Cloud. No additional configuration required — it is on by default for every byte stored.
All traffic is served exclusively over HTTPS. HTTP connections are not accepted. HSTS is enforced with a one-year max-age, including subdomains, preventing any unencrypted access.
Access is enforced at the database layer — not just the UI. Every read and write is checked against the requesting user's role. Unauthenticated access to any data is not possible.
Every workspace is isolated at the database rules layer. A user in one organisation cannot access another organisation's projects, documents, or correspondence — regardless of any application-level logic.
All major records — defects, documents, RFIs, actions, correspondence — maintain a full audit log of every state change: who made it, when, and what changed. This log cannot be edited by users.
Strova contains no third-party analytics, ad trackers, or behavioural profiling tools. No data is shared with advertising networks. Interest-cohort tracking (FLoC) is explicitly disabled.
Strova uses three user roles per project. Permissions are enforced server-side — changing the URL or API request cannot bypass them.
Strova runs entirely on Firebase and Google Cloud services. Google holds the following certifications relevant to enterprise and government customers across the Asia-Pacific region.
Google Cloud's full compliance documentation is available at cloud.google.com/compliance
Every response from app.strovapi.com includes the following HTTP security headers, applied at the hosting layer — they cannot be bypassed by application code.
| Header | Purpose |
|---|---|
| Strict-Transport-Security | Enforces HTTPS for 1 year across all subdomains. Preload-eligible — major browsers will never attempt an unencrypted connection. |
| Content-Security-Policy | Restricts which scripts, styles, and resources can load. Inline scripts from unknown sources are blocked. Framing is denied entirely. |
| X-Frame-Options | DENY — the application cannot be embedded in an iframe on any external site, preventing clickjacking attacks. |
| X-Content-Type-Options | nosniff — browsers cannot override the declared content type, preventing MIME-sniffing attacks. |
| Referrer-Policy | strict-origin-when-cross-origin — limits referrer information sent to external sites. |
| Permissions-Policy | Microphone, geolocation, and interest-cohort tracking are explicitly disabled. Camera access is restricted to the application itself. |
australia-southeast2 — Melbourne, Australiaaustralia-southeast2 Australia · asia-southeast1 SingaporeEnterprise deployments, government projects, and clients with specific compliance obligations — talk to us directly.