Security
How Structra protects your firm's data
Your projects hold client records, property details, drawings and sealed reports. This page describes the controls in place today. For a vendor review, we complete security questionnaires and answer follow-up questions directly.
Data separation
- Every record belongs to one firm. Staff see their own firm's work.
- Client users see only their own organization's jobs, and never the firm's internal notes.
Access control
- Role-based permissions for firm staff, client administrators, client office staff and inspectors.
- Passwords are hashed with Argon2id. Field inspectors sign in with one-time codes.
- Firm and client administrators add, change and deactivate their own users.
Infrastructure
- Hosted in data centers in the United States.
- All traffic is encrypted in transit with TLS.
- The application connects to its database with least-privilege logins, not an administrator account.
Backup and recovery
- Automated database backups are stored off-site, separate from the production servers.
- Backups are retained for 35 days.
- Restores from the off-site copy are tested.
Record keeping
- Each project keeps a history of its status changes and delivered files.
- Electronically signed documents carry a signature certificate: signer, sent, viewed and signed times, IP address, browser, the consent given and a SHA-256 fingerprint of the signed document.
- Each AI run records the prompt version, the model and a fingerprint of the documents it read.
Running a vendor review?
Send us your questionnaire. Privacy practices are in the Privacy Policy.