Subprocessor List and
Security Overview.

Part 1: Subprocessors

These companies process personal information in customer data for us:

Park-chosen services. Each park connects its own payment processor (for example, Stripe), its own email server and, optionally, its accounting software or text-message provider. These are the park’s own vendors under the park’s own agreements, not our subprocessors.

Services that receive no personal information. To show weather and the park’s location, StrataPMS asks the U.S. National Weather Service, the U.S. Census Bureau geocoder and OpenStreetMap Nominatim for information using only the park’s coordinates or business address. Open-Meteo: air-quality index, used once enabled (commercial plan); receives only the park’s coordinates.

Changes. We give customers at least 30 days’ notice before adding or replacing a subprocessor, as the Data Processing Addendum provides.

Part 2: Security overview

Hosting and separation

• StrataPMS runs on dedicated cloud servers in the United States.
• Each park has its own database, its own database login, its own application process and its own secret key. Automated tests check that one park cannot open another park’s data, and the server firewall stops park processes from reaching one another.

Encryption

• All connections use HTTPS with modern TLS certificates. Browsers are told to use only secure connections (HTTP Strict Transport Security).
• Sensitive secrets are encrypted with AES-256-GCM, including authenticator secrets, park email passwords and each user’s AI helper memory, which has its own key.
• Passwords are stored only as one-way hashes (scrypt).

Sign-in and access

• Staff sign in with a password and can add an authenticator app or a passkey. A computer can be remembered for up to 30 days at the user’s choice.
• Users are alerted to new sign-ins, and repeated failed attempts are throttled.
• Every user has a role with specific permissions set by the park.
• AI helpers can only propose actions. A person must confirm each action, and it runs with that person’s permissions.

Payments

• Card numbers are typed into the payment processor’s secure fields and go directly to the processor. StrataPMS never receives or stores full card numbers or security codes. It keeps only the processor’s token and the card’s last four digits.

Financial record integrity

• Financial records are written to an append-only ledger. Each ledger stream is linked by a cryptographic hash chain, so later changes can be detected.

AI safeguards

• Before anything is sent to an AI provider, StrataPMS blocks card numbers, security codes, passwords, sign-in tokens, gate and door codes, PINs, Social Security-style numbers and bank account numbers.
• We use AI providers only under terms that do not allow them to train their models on customer data.

Server protection

• Production services run under separate system accounts without administrator rights.
• Configuration secrets are readable only by the system administrator.
• Server access is limited to authorized personnel using key-based sign-in.

Backups and recovery

• Every night, a copy of each database is encrypted and sent to off-site storage, where it is kept for 90 days. Further copies are taken before each release and kept on the production server with administrator-only access.
• We test restoring from these copies. Parks should still keep their own copies of records they cannot afford to lose.

People and process

• Access to customer data is limited to DCV Systems personnel and contractors who need it to provide or support the service and who are bound by confidentiality agreements.
• Security incidents affecting personal information are reported to affected parks within 72 hours after we confirm them, as the Data Processing Addendum provides.
• Security vulnerabilities can be reported to hello@stratapms.com.

What parks are responsible for

• Keeping staff sign-in credentials secret and removing former staff promptly.
• Their own payment processor account and their own obligations under the Payment Card Industry Data Security Standard.

Contact

Security reports: hello@stratapms.com
Privacy: privacy@stratapms.com

DCV Systems, LLC
915 SW Rimrock Way, Suite 201-172
Redmond, OR 97756

Related documents

See also our Master Subscription Agreement, Data Processing Addendum, Service Level and Support Policy, the Privacy Policy and the Terms of Service.