Privacy, data and retention
Where your data lives, who can reach it, what the audit trail records, how long things are kept, and how to get your data out.
A strata corporation holds personal information about everyone who lives in the building. That comes with obligations under PIPA (BC and Alberta) and PIPEDA, and they belong to the corporation, not to its software vendor.
Where your data lives
Your corporation's data is hosted in a Canadian region, handled under PIPA and PIPEDA.
Some AI processing happens outside Canada
AI features — document Q&A, the Assistant, drafts, agents — send the relevant content to a language-model provider under contract, and that processing may occur outside Canada. This is a real limitation and worth knowing rather than glossing over.
If your corporation has taken a position that no personal information may leave Canada, don't use the AI features. Every core function — compliance, meetings, voting, the books, storage, maintenance — works without them. The full detail is in the privacy policy.
Who can see what
Access is enforced in the database itself, not just in the menus. Each query is filtered by who is asking.
Owners see their own account, and the building information published to them. Not the corporation's finances, not other owners' accounts, not the roster's contact details.
Council and managers see the corporation's records — that's the job.
Between corporations, nothing crosses. A manager with five buildings sees five separate workspaces.
Detail in roles and permissions.
The audit trail
SettingsRecords records who did what and when: money moved, invoices cancelled, roles changed, documents uploaded, notices sent, periods closed and reopened.
You'll rarely read it. It matters at the moments it matters a lot — an owner questioning a two-year-old charge, a handover to a new council, a tribunal.
Shared logins destroy it
The trail records the account that acted. Four people sharing one login turns every entry into "somebody on council", which answers nothing. Individual logins cost nothing. See invitations and logins.
Retention
Not yet a setting you can change
ManageStrata retains records against the statutory minimums for your province. There is no retention screen in the product today — the policy is not yet configurable per corporation, and nothing is purged on a schedule you set. The guidance below is about your own record-keeping obligations, which apply either way.
Your legislation sets minimums, and they vary by record type — financial records and minutes are typically kept for years, some records longer where they touch major work or the reserve.
Practical guidance:
- Set retention to meet your statutory minimum at least. Deleting something you were required to keep is the expensive mistake.
- Keep minutes and financial statements indefinitely. They're small and they answer questions nothing else can.
- Be more careful with personal information. Correspondence about an individual owner, a complaint file, a dispute — hold those no longer than you need. Holding personal information without a reason is its own problem.
Owners' access rights
Your province's legislation gives owners a right to certain corporate records, and that right exists regardless of what you've chosen to publish in the document library.
The library is a convenience. It is not a determination of what an owner is entitled to. When a formal records request arrives, check what your Act requires and produce it. If a request is unusual, take advice.
Handling personal information well
Councils get this wrong more often through carelessness than intent:
- Never name an individual owner in an announcement. Arrears, complaints, disputes — direct to the person concerned.
- Don't circulate the roster. Contact details are held for the corporation's purposes, not for the building's use.
- Think before uploading. Legal advice, medical information, a complaint file — consider whether it belongs in a shared library at all.
- Minute decisions, not personalities. Everything you write is disclosable.
Getting your data out
Your data is yours. Financial statements, ledgers and documents can be exported, and your documents can be downloaded from the library.
If you're leaving ManageStrata, export before your paid period ends. Ask support if you need a full export.
Security basics
- Individual logins, never shared.
- Remove access promptly when someone leaves council or sells.
- A strong, unique password. Nobody at ManageStrata can see or set it.
- Review who has access yearly.
- Support will never ask for your password. Anyone who does is not us.
Breaches
If something goes wrong at our end, we'll tell you. If something goes wrong at yours — a compromised council email account, a shared login used by someone who shouldn't have it — the corporation has its own notification obligations under PIPA/PIPEDA. Take advice quickly; the timelines are short.
Still stuck? Open Support in the top bar of the app, ask the Assistant, or contact us.