STRUCTASecurity
Security is built into how Structa is designed — starting in the database, not the interface. We’re an early-stage product and say so honestly: no formal certifications yet (SOC 2, HIPAA), and this page describes exactly what is in place today.
Tenant isolation, enforced in the database
Every record belongs to exactly one business. PostgreSQL Row-Level Security scopes reads and writes to the signed-in user's business — the primary wall between businesses is the database itself, not the interface. Our deploy gate re-proves it: an employee of one business is checked to read zero rows of any other.
Your role is your key
An employee reaches a module only when the business has it switched on and their role carries it — two people on the same tablet get two different workspaces. Billing, roles and business configuration are the owner's alone.
A permission is one operation, not a rank
Below the manager flag, a role can be granted a single named operation — see the shipment queue, take the next job — without also getting the roster, everyone's schedule and the money screens. The check runs in the database, in the one place the defaults are written down.
Manager approvals
Certain corrections (voiding a payment, editing punches) require a manager's approval, protected by a per-manager PIN with rate limiting.
Only a device a manager trusted
A PIN never signs anyone in on its own. Tapping your card works only on a tablet that was explicitly activated from the owner's console: the device keeps a token, the database keeps only its hash, and revoking the device ends the card screen on it immediately.
Encryption
Data is encrypted in transit over TLS/HTTPS and encrypted at rest by our infrastructure providers. Server-only secrets are never exposed to the browser.
Payments by Stripe
Card payments are handled by Stripe, a PCI-DSS compliant processor. Structa never sees or stores full card numbers.
The document room
Business papers are uploaded through the server, never straight from a browser: the file type must agree with its own extension, the first bytes are checked against it, and anything that looks like a program is refused. A download hands back a signed link that dies in sixty seconds, and both the upload and the download are on the record.
Webhooks you can verify
Events we push to your systems are signed HMAC-SHA256 with a secret belonging to that one endpoint, and the timestamp is inside the signature — so a delivery somebody captured cannot be replayed at you later. Endpoints must be https, the secret cannot be read from a browser, and every attempt is recorded with its status, its error and how long it took.
Keys shown once, revoked for good
An API key is displayed once, belongs to one business, and reads only — every other verb is refused. Revoking it takes effect immediately and cannot be undone.
Append-only audit trail
Sensitive actions are logged for accountability — AI assistant actions, payment voids and reversals, manager-PIN attempts, labels bought and providers connected. Logs are readable only by an owner or manager, and nothing in the product can edit or delete a line.
What the assistant is not allowed to see
The AI answers from rows your role could already open, and it acts only on a card a person presses. Private messages between colleagues sit outside it entirely: no assistant tool reaches those tables, and a test in our build refuses a change that adds one.
Your data is yours
The owner downloads a full export from their own console, any time, free, including after you cancel — and can have the whole business permanently erased on request. Prefer we did it? Email support@structainc.com and the export comes back within two business days. If we ever wound the service down, every business would get at least 60 days’ notice and an export window before anything is deleted.
Where we handle your customers’ personal data on your behalf, the terms are written down in the Data Processing Agreement — including the sub-processors we use and what each of them sees.
Reporting a vulnerability
We appreciate responsible disclosure. If you believe you’ve found a security issue, email security@structainc.com with details and steps to reproduce, and please hold public disclosure until we’ve investigated and responded.