STRUCTASecurity
Security is built into how Structa is designed — starting in the database, not the interface. We’re an early-stage product and say so honestly: no formal certifications yet (SOC 2, HIPAA), and this page describes exactly what is in place today.
Tenant isolation, enforced in the database
Every record belongs to exactly one business. PostgreSQL Row-Level Security scopes reads and writes to the signed-in user's business — the primary wall between businesses is the database itself, not the interface.
Role-based access
An employee only sees the modules their role is granted. Sensitive settings — billing, roles, business configuration — are restricted to the business owner.
Manager approvals
Certain corrections (voiding a payment, editing punches) require a manager's approval, protected by a per-manager PIN with rate limiting.
Encryption
Data is encrypted in transit over TLS/HTTPS and encrypted at rest by our infrastructure providers. Server-only secrets are never exposed to the browser.
Payments by Stripe
Card payments are handled by Stripe, a PCI-DSS compliant processor. Structa never sees or stores full card numbers.
Append-only audit trail
Sensitive actions are logged for accountability — AI assistant actions, payment voids and reversals, manager-PIN attempts. Logs are readable only by an owner or manager.
Your data is yours
Email support@structainc.com and we provide a full export within two business days, free of charge — including after you cancel. If we ever wound the service down, every business would get at least 60 days’ notice and an export window before anything is deleted.
Reporting a vulnerability
We appreciate responsible disclosure. If you believe you’ve found a security issue, email security@structainc.com with details and steps to reproduce, and please hold public disclosure until we’ve investigated and responded.