Network-level abuse protection
Authentication throttles are shared through PostgreSQL. A managed edge limiter or WAF is still recommended for broad network abuse and volumetric protection.
Public security reference
Security controls and
operating boundaries.
This page maps implemented Struct product controls to common security and SOC 2 trust-services concerns. It is a readiness aid—not a certification, legal opinion, audit report, or substitute for an auditor-approved control matrix.
Scope of this reference
Product controls are listed separately from the policies, infrastructure, monitoring, reviews, and evidence that an operator must maintain in production.
Implemented controls
What Struct handles—and what operators must provide.
The control is implemented in Struct; the responsibility column identifies work that remains with the organization operating the service.
| Concern | Implemented Struct control | Operator responsibility |
|---|---|---|
| Logical access | Opaque server sessions, Google Identity Platform SMS MFA with reCAPTCHA, transitional authenticator MFA, OIDC SSO, organization roles, and member suspension. | Access policy, joiner/mover/leaver process, and periodic access review. |
| Tenant isolation | Organization identity and permission checks cover project, grant, version, share, and WebSocket operations. | Authorization regression review and production monitoring. |
| Least privilege | Owner, admin, member, and viewer roles plus per-project editor or viewer grants. | Role definitions, approvals, and recurring entitlement review. |
| Authentication integrity | OIDC discovery, PKCE, nonce and state validation, signature, issuer and audience checks, verified email, and domain allowlists. | Identity-provider MFA and session policy plus a documented break-glass process. |
| Credential protection | Argon2id password hashes; AES-256-GCM OIDC secrets; hashed session, invitation, share, and recovery tokens. | Key custody, managed secret storage, rotation, and breach response. |
| Web security | CSRF tokens, trusted-origin checks, CSP nonces, exact WebSocket origin checks, HSTS, and frame, MIME, and permissions headers. | TLS and domain management, edge protections, and periodic scanning. |
| Change integrity | Versioned migrations, optimistic project versions, and retained project checkpoints. | Reviews, approvals, segregation of duties, and rollback evidence. |
| Auditability | Administrative, membership, invitation, SSO, project, share, and MFA events are recorded by the application. | Central retention, alerting, periodic review, and clock synchronization. |
| Availability | Health and readiness endpoints, graceful shutdown, and managed-database deployment support. | Monitoring, capacity planning, on-call response, incident process, and disaster-recovery targets. |
| Data lifecycle | Soft deletion, organization-configured deleted-project purge, and expired session, invitation, and share cleanup. | Contractual retention, backup expiry, and deletion-request procedures. |
| Confidentiality | Same-origin transport, authenticated access, encrypted provider secrets, and exclusion of diagram content from product analytics. | Database and backup encryption, vendor review, and DLP policy. |
| Recovery | PostgreSQL backup and restore procedures plus portable Struct project export for offline work. | Scheduled backups, isolated restore drills, and approved RPO and RTO targets. |
Known boundaries
Where Struct’s controls stop.
Mailbox ownership verification
Invitations use a private copy-link workflow. Password registration does not claim mailbox ownership verification; governed tenants should require identity-provider-verified SSO.
Immutable audit storage
Application audit events are not WORM storage. Export or stream them to an organization-controlled logging platform when immutable retention is required.
Hosting-layer encryption
Database-at-rest and backup encryption depend on the selected PostgreSQL and hosting services and must be verified by the operator.
Administrative systems outside Struct
Struct does not claim procurement approvals, DLP, eDiscovery, SCIM, legal hold, or custom tax and commercial workflows in this release.
Production evidence
Evidence to retain for an audit.
Maintain the system description; data-flow and trust-boundary diagrams; access reviews; identity policy; key inventory; vendor and risk reviews; secure-development policy; code-review and CI results; dependency or SBOM evidence; migration approvals; deployment records; vulnerability-management results; uptime and incident evidence; backup reports; restore drills; retention-job evidence; organization audit exports; and remediation records for the observation period defined by your auditor.