Straight answers for your security review
Written for the person filling in a questionnaire. Several of the answers below are “no”. They are stated as plainly as the rest, because a precise no is worth more to you than a vague yes.
Your documents
Are my documents public?
No. Documents belong to a workspace inside your organisation. Every route that returns document content requires an authenticated session, membership of that workspace, and the specific permission for the action. There is no public or unauthenticated route that returns document content, and no shareable link is generated for original files.
Where are my documents stored?
Original files are held in Cloudflare R2 object storage under a key path scoped to your organisation and workspace. Extracted text, passages and search vectors are held in a managed PostgreSQL database on Railway. We will confirm regions in writing on request.
Is my data encrypted?
In transit, the product is served over HTTPS. At rest, object storage (Cloudflare R2) encrypts every stored object as a property of the platform; our uploads also request server-side encryption. Database and cache encryption at rest are properties of the managed hosting platform (Railway), which we will confirm in writing rather than claim here.
How is my workspace isolated from other customers?
Every tenant-scoped route carries the workspace in its path and resolves your membership and permissions before returning anything. Object storage keys are prefixed by organisation and workspace. Isolation is enforced in the application layer rather than by a per-tenant database.
AI processing
Do you train a public model on my documents?
No. DataStruct does not train any model, public or private, on your content. We call third-party AI providers through their APIs under terms that exclude training on API data.
Which AI providers receive my data?
OpenAI only, in the current configuration. No other AI provider receives customer content.
What exactly is sent to the AI provider?
Passages and extracts, not whole files. When you ask a question or run a requirement: your question and the retrieved passages the answer is built on. When a document is ingested: chunks of its text for embedding, and an extract for claim detection. When field extraction runs: a portion of the document text.
Do you have a Zero Data Retention agreement?
No. We hold no ZDR agreement with any provider. Provider APIs are used under terms that exclude training on API data, which is a different and weaker statement, and it is the only one we can support.
Deletion and retention
Can I delete my data, and what actually happens?
The honest answer has two parts. Deleting a document in the app is a soft delete — it disappears immediately from search, from Q&A, from every list and from every new evidence pack, and cannot be retrieved through the product. The underlying file is retained until a hard purge is run. The purge deletes the stored object, verifies the object is gone, and removes the associated records — but today it is an operator-run action, not a self-serve button. During the beta, ask us and we will run it and confirm completion. A database backup taken before the purge can hold a copy until it is rotated, within 30 days; we tell you that date when we confirm.
How long is my data retained?
For the duration of your pilot and until you ask us to remove it. There is no customer-configurable retention window, and no automatic retention job runs during the beta. At the end of a pilot we remove your workspace's documents and derived data on request and confirm it. A self-serve GDPR export (Article 15) and account deletion are available in settings; where deletion cannot be completed self-serve — for example by the sole owner of an organisation — we complete it for you on request.
What is retained in backups?
During the private beta, database backups are operator-run snapshots, taken daily while a pilot holds documents and before every release; platform point-in-time recovery is being enabled before paid pilots begin. A backup is a point-in-time copy, so content deleted after it was taken can exist in it until it is rotated, within 30 days. We will confirm the current configuration in writing on request.
Who at DataStruct can access my workspace?
Access requires workspace membership. A platform administrator role exists for operational support and hard purges and can reach organisation and workspace data. Administrator write actions (provisioning, suspension, purges, policy changes) are recorded in the audit log; administrator read access is not currently logged.
Decisions, certifications and identity
Does DataStruct make compliance decisions?
No, and it is designed not to. DataStruct locates and prepares evidence and states what it could not confirm. Every finding carries a state — evidence located, partial, support not confirmed — and a separate reviewer decision that only a person can write. There is no path for the system to record a compliance verdict of its own, and an unreviewed finding is excluded from every acceptance figure. It can fail in both directions: it may withhold evidence a reviewer would accept, and it may occasionally present related material as supporting. That is why the reviewer step is mandatory rather than advisory.
Do you have SOC 2?
No. No SOC 2 examination has been performed and we hold no report of any type. We have documented controls across access, audit, encryption and incident response and are happy to walk through them — but we will not describe that as SOC 2.
Do you support single sign-on?
Not as a generally available feature. OAuth and OIDC sign-on exist in the codebase but are not configured or proven in production, so we do not offer them during the beta. Beta accounts use email and password. SSO is on the roadmap.
Do you offer data residency, a dedicated environment, self-hosting or an SLA?
Not today. The service runs in a single US region on shared infrastructure. There is no EU or UK residency option, no single-tenant or customer-hosted deployment, and no contractual SLA. Private deployment options are on the exploring list of our roadmap.
How is access to a workspace controlled?
Four workspace roles (Owner, Admin, Member, Viewer) with granular permissions; each workspace endpoint is permission-gated. API keys are stored hashed, can carry an expiry, and are revoked immediately. Sessions use short-lived tokens with a sign-out-everywhere control in settings. Per-organisation AI usage caps stop processing at the limit.
What can you share for a procurement review?
A Data Processing Addendum on request, the sub-processor list published in our privacy policy, and a working session on data flows, access control, audit and incident handling. We have no third-party penetration test report and no reference customers to offer yet, and we say so on the questionnaire rather than imply otherwise.
What is logged?
Sensitive actions are recorded in an audit log with the acting user and, where a value changed, its previous and new state. Reviewer decisions on findings are always attributed and logged.
Something not answered here?
Send us the questionnaire. We would rather give you a precise answer, including where the answer is no, than have you discover it later.