How your data is secured
This page is a plain-language explanation of exactly what happens to uploaded data, what security controls are in place, and what Struktive's data handling commitments are. It is not a legal document — it is a direct answer to the question: "I'm about to upload our equipment register — what happens to my data?"
The short version
Five facts that cover the most common concerns.
Your raw file is deleted within 24 hours
We delete your uploaded CSV from our storage servers as soon as your job completes. We keep the normalised results — not your original file.
Your data is never used to train AI models
The normalisation pipeline uses your data to produce your results only. We do not use uploaded asset data for any other purpose.
Jobs are isolated — no one else can see yours
Every job is tied to your account or session. Anonymous jobs are accessible only via your unique job ID for 90 days.
Results are encrypted in transit and at rest
All connections are TLS 1.2+. Data stored at rest uses AES-256 encryption at the infrastructure level.
Compliance audit packs are tamper-evident
Every compliance pack receives a SHA-256 hash at generation time. You can verify the integrity of any pack at struktive.io/verify — no login required.
Data lifecycle
What happens to your data at each stage of the pipeline.
Upload
Your CSV or Excel file is transmitted to our servers over TLS 1.2+. File type is validated before any processing begins. Maximum file size: 50 MB.
Processing
Your file is processed by the 7-stage normalisation pipeline. Raw data is held in memory only during processing — not written to additional storage locations.
Results stored
Normalised records are stored in our database tied to your job ID. Your original raw values are preserved alongside normalised values in the same record.
File deleted
Your original uploaded file is deleted from our storage servers on job completion. This happens automatically — you do not need to request it.
Results available
Your normalised results and export files are available for download for the duration of your retention period (90 days free, 12 months paid).
Retention expiry
Job records and associated asset data are automatically purged at the end of the retention period. Compliance audit packs are retained for 12 months regardless of tier.
SOC 2 certification status and our roadmap for formal certification is addressed in our Security FAQ.
Verify audit pack integrity
Every Compliance Audit Pack has a SHA-256 hash stored in a tamper-evident registry. You can verify the integrity of any pack at any time — no login required.
Go to VerifyTechnical security controls
For IT security reviewers and enterprise procurement teams. These controls map directly to what is implemented in the codebase.
TLS 1.2+ on all connections
All HTTP traffic served over HTTPS. HTTP requests redirected to HTTPS.
Security headers on all responses
Helmet middleware: HSTS, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy.
Rate limiting — three tiers
120 requests/minute general API. 5 attempts/15 min auth endpoints. 3 attempts/15 min password reset. 10 uploads/hour anonymous.
JWT session authentication
HttpOnly cookie-based sessions. Cryptographically signed with server secret. 1-year expiry.
CSV formula injection prevention
All output cells sanitised before export. Leading formula characters (=, +, −, @) prefixed to prevent spreadsheet injection attacks.
Tamper-evident audit packs
SHA-256 hash recorded at generation time. Integrity verifiable at any time via /verify endpoint. WORM database semantics on audit pack records.
Password security
Passwords hashed with bcrypt. Reset tokens expire in 1 hour. Email verification required on registration.
API key authentication
API keys scoped to normalise permissions by default. Keys stored as hashed values — plain text never stored after generation.
Input validation
File type validated server-side. Body size limits enforced. SQL injection prevented by parameterised queries via Drizzle ORM.
Audit logging
Authentication events, purchases, and admin actions logged with timestamp and user context.
Data handling commitments
Plain language. No legal hedging.
| Commitment | What it means |
|---|---|
| We do not sell your data | Uploaded asset data is never sold to third parties, data brokers, or any other organisation. |
| We do not share your data with other customers | Your equipment register, parts catalog, and normalised results are never shared with or visible to other Struktive users. |
| We do not use your data to train AI models | The LLM inference used in the classification stage processes your data to produce your results only. It is not used to fine-tune models or build training datasets. |
| We do not retain raw files | Your original uploaded file is deleted within 24 hours of job completion. We do not keep backups of raw uploads. |
| You can request deletion at any time | Account holders can request deletion of all their job data and account information via account settings or by contacting support. We will confirm deletion within 5 business days. |
| Anonymous job data is automatically purged | Jobs processed without an account are purged after 90 days. No action required from you. |
Raw files
Deleted within 24 hours of job completion
Normalised results
Free tier: 90 days
Paid tier: 12 months
Compliance audit packs
12 months · tamper-evident SHA-256
Responsible disclosure
If you discover a security vulnerability in Struktive, please report it to security [at] struktive [dot] io(written this way to prevent automated harvesting — copy and replace [at] with @ and [dot] with .). We will acknowledge your report within 2 business days and aim to resolve confirmed vulnerabilities within 30 days. We do not take legal action against researchers acting in good faith.
Questions about data handling?
Our team responds to security and privacy questions within 1 business day.