Security your procurement team can sign off

A plain-language summary of how StructCHA handles your organisation's data. We only list controls that are live today.

Data residency

Workspace data and files are stored on managed cloud infrastructure in the EU, a jurisdiction recognised for strong data-protection law. Ask us for current sub-processor details.

Encryption

All traffic uses HTTPS/TLS. Databases, backups and stored files are encrypted at rest by our infrastructure provider.

Tenant isolation

Every record is tied to a workspace. Database row-level security policies stop one organisation from reading another's data — even through direct requests.

Role-based access

Super admin, manager, executive, member and guest roles. Guests only see projects they are added to and cannot create work or browse the organisation.

Sign-in protection

Password plus a one-time email code, leaked-password screening, current-password checks on password changes, and Google sign-in.

Private files

Client attachments are stored privately and served through short-lived links issued only after access is checked.

Incident response

Report a suspected issue to security@structcha.com. We investigate promptly and notify affected customers and the Information Regulator where POPIA requires it.

POPIA commitments

We process personal information only to provide the service you signed up for.
Data subjects can request access, correction or deletion via privacy@structcha.com; we respond within 30 days.
Workspace admins control who is invited and can remove members at any time.
We don't sell personal information or use your project content to train public AI models.

StructCHA aligns its practices with POPIA. We don't currently hold an ISO 27001 or SOC 2 certification.