Built for regulated document workflows

28 granular permissions across four roles (Owner, Admin, Member, Viewer). Every workspace endpoint is permission-gated.

Organisation → Workspace → Membership hierarchy with strict tenant boundaries enforced at the data and API layer.

Hashed, prefix-indexed API keys with optional expiry and per-key usage tracking. Revocation is immediate.

Google OAuth and generic OIDC support for enterprise single sign-on. SAML available on Enterprise on request.

Short-lived JWT access tokens with refresh; sign-out everywhere from the user settings page.

Every Q&A answer cites the exact source paragraph. Reviewers can click through to verify.

Generated citations are checked against the retrieval set; fabricated references are flagged before reaching the user.

A second model pass evaluates each claim against the cited evidence and flags unsupported claims in system logs for operator review.

When confidence falls below threshold, the system says "insufficient evidence" rather than guessing.

Low-confidence extraction results and low-confidence answers auto-route to a human review queue. Approve, reject, or edit; every decision is recorded.

Sensitive actions (uploads, AI calls, review decisions, rule overrides, configuration changes) are logged with actor, target, and before/after values.

TLS 1.2+ for all API and frontend traffic. HSTS enforced.

AES-256 server-side encryption on document object storage. Database disk encryption inherited from the managed Postgres provider.

Documents stored in customer-controllable S3 buckets when self-hosting; managed buckets when on multi-tenant SaaS.

Most resources use soft-delete with timestamps so accidental deletes are recoverable for the retention window.

GDPR Article 15 (export) and Article 17 (erasure) self-serve from the user settings page; bulk export available via API on Business and above.

Per-resource retention windows configurable per workspace.

DataStruct AI runs on managed AI infrastructure so customers can start quickly. Usage is governed by fair-use limits to protect performance and cost predictability.

Each organisation has daily and monthly AI cost caps with hard-stop at the limit and an audit log warning at the warning threshold. Limits are set per contract.

Every AI provider call (Q&A, verification, search reranking, query and document embeddings, extraction and claim extraction) is recorded with provider, model, token counts, estimated cost, and credential source.

Customer documents are not used to train DataStruct AI foundation models. Where third-party AI providers process content, retention and handling depend on the selected provider, account configuration, and contracted controls.

For organisations that require direct control over provider billing and data-handling settings, customer-managed AI provider keys are on the enterprise roadmap. Contact sales to discuss timelines.

Azure OpenAI routing and provider-level retention controls (including Zero Data Retention where eligible) are on the enterprise roadmap for procurement-driven deployments.

Optional redaction of common PII (emails, phone numbers, identifiers) before evidence chunks are sent to the AI provider. On the roadmap.

Document and workflow events fire to your endpoint with HMAC-SHA256 signatures, exponential retry, and auto-disable after repeated failures.

Per-IP request rate limits on API endpoints, plus per-organisation daily and monthly AI cost caps.

Daily AI cost ceiling with warning threshold and audit logging. Budget alerts surface in the operator console.

/health and /health/ready endpoints expose database and Redis connectivity for load balancer probes.

JSON-structured logs with request IDs for tracing. Sentry integration for error monitoring.

Public /admin/ops/info endpoint exposes which subsystems are configured (AI, email, billing, storage) so banners can warn users instead of letting them hit confusing errors.

Self-serve Article 15 export and Article 17 erasure endpoints. Right-to-rectification supported via account profile updates and audit-logged data corrections.

Standard Data Processing Addendum available on request and shared during procurement.

EU SCCs for international transfers available on Enterprise engagements.

Sub-processor list shared during procurement. Notification of material changes via email.

SOC 2-aligned controls in place across access, audit, encryption, and incident response. Type I report planned; Type II audit timeline shared during procurement.

Documented incident response procedure with severity classification, communication SLAs, and post-incident reviews.

Standard questionnaires (SIG, CAIQ, custom forms) returned within 5 business days during active procurement.

Working session with your security team to walk through data flows, access model, encryption, and incident response.

EU data residency available on Enterprise engagements; additional regions on request.

Single-tenant deployment available on Enterprise. Pricing reflects the dedicated infrastructure.

On-request introductions to existing customers (subject to mutual NDA).