Security
Last updated: 1 November 2026
This page describes the controls in the product today, and it is not a certification, a SOC 2 report, an ISO 27001 report, or a penetration test.
Hosting and region
The API, the background worker and the database run on Railway in Singapore. The database is not in Sydney. The website is served by Vercel, Inc., a United States company, and the functions run in Singapore (sin1). Uploaded files are stored in Cloudflare R2 with an Oceania location hint. The hint is best effort and does not guarantee the files stay in Australia.
Moving the API, the worker, the database or the website to Sydney is a plan for after launch.
Encryption in transit
The site and the API are served over HTTPS. Browsers are told to stay on HTTPS. Responses cannot be framed by another site. These protections are on every response, including errors.
The database connection is encrypted.
Encryption at rest
Railway, Vercel, Cloudflare R2, Resend, Sentry and OpenAI use AES-256 encryption at rest. Clerk uses industry-standard encryption. Encryption at rest for Anthropic is to be confirmed before launch.
Access control
Sign-in is Clerk. A person opens a project when their role in that workspace allows it. Closing an account does not delete a workspace project that another current member still uses. A session that has been idle for 12 hours is signed out.
Multi-factor authentication can be turned on at sign-in. It is not required on every account. There is no single sign-on and no directory sync.
Backups
How long database backups are kept is to be confirmed before launch. Deleting a project or a file in the product does not remove those backups sooner.
Logging and audit
Each response carries a request id. We log which action was taken, on what, and whether it worked. That record does not include what you typed or uploaded. A data export is written to the audit log. A finding's status history is kept with the finding. Error reports are sent only when error reporting is on, and the sign-in header is removed before a report is sent.
Vulnerability disclosure
Report a vulnerability to contact@structbyai.com. The same address is published at /.well-known/security.txt on the website and on the API. There is no bug-bounty programme.
How soon we acknowledge that message is to be confirmed before launch.
Incident response
- You, or anyone else, writes to contact@structbyai.com.
- How soon we acknowledge that message is to be confirmed before launch.
- We use the request id and the audit log to see what happened, and we keep those records.
- If the Notifiable Data Breaches scheme or the Digital Personal Data Protection Act 2023 requires a notice, we follow that requirement. Any shorter time we offer a customer is to be confirmed before launch.
What you can take with you
From Settings, under Legal, you can ask for a copy of your own projects, documents and their versions, design values, files, questions, StructCheck runs, site assessments and your own audit entries. The download link lasts 10 minutes. Page images are not included. This is not every record the service holds. A workspace owner or admin can ask for that workspace's projects, documents and files separately. Questions and checks in that download are still only their own. Another member appears as a display name.
