Isolation by architecture,
not by policy.
Your company gets its own Google Cloud Project on day one. Your files, figures and database live inside it, and no other company’s data does. That boundary is built in, not a setting someone could change.
- ISO 27001-aligned controls · not yet certified
- UK GDPR
- POPIA
Your team
Only what each role allows
YOUR OWN PROJECT
In your country · London
- Files and figures
- Database
- Your search index
Struktürs staff
No standing access
Other companies
Refused
AI models
Shared · sent only the extracts a question needs. Never train on it. Keep it only if flagged as possible abuse.
We monitor errors, speed and cost. Those records hold no figures or names.
The short version
Four questions your board will ask. Straight answers.
Where is our data?
In the country you choose at sign-up: London for a company in the United Kingdom, Johannesburg for one in South Africa, and the European Union, the United States and Canada as each opens. Your files, figures and database are stored in your country. Some processing happens elsewhere, and here it is. For UK companies, to answer a request, only the text that request needs is sent to Claude in Belgium (or Gemini in London, if it's unavailable). Reading uploaded narrative documents uses Google Document AI in the European Union. Both are transfers to the European Union under the UK’s adequacy regulations. For South African companies, to answer a request, only the text that request needs is sent to Claude in Belgium (or Gemini in London, if it's unavailable). Other AI features, such as narrative explanations and account mapping, and the search indexes run in London, as do signing in, onboarding, billing and workspace administration. What leaves South Africa goes under section 72 of POPIA, only to recipients bound by agreements that give your data an adequate level of protection. Where an AI model has no endpoint in your country, we say which country it runs in, here and in our Privacy Policy. Scheduled jobs start from London and carry no files or figures.
Who can see it?
Your team, and only the parts their role allows. Your board sees finished work only. No one at Struktürs has standing access to your workspace. If we ever need to look at your data to fix something, one named person gets access for that one incident only, for at most four hours. It’s recorded, and a second person reviews it. We do monitor how the service runs (errors, speed, cost, and whether answers found their sources), and those records hold no figures, documents or names.
What does the AI see?
Only the extracts a question needs, never your ledger wholesale. Drafting an article from a document you attach sends that document’s text. The models are Anthropic’s Claude and Google’s Gemini, on Google Cloud. Google, which runs the AI models, does not use your requests to train them. If its automated checks flag a request as possible abuse, Google may keep that request for up to 90 days to review it. Nothing they write goes on your record until your team approves it.
How do we leave?
On request, your records and audit trail as open files (JSONL and Parquet), with a SHA-256 manifest of every file. After the 3-month pilot, 30 days’ notice ends the subscription.
What we’ll never let the AI do
Five limits, built in. Test us on any of them.
- 01
It proposes. It never decides.
Every mapping, article, admission to the Vault and board pack section needs a named person on your team to approve it.
- 02
It never fills a gap with a guess.
When the data isn’t good enough for what you asked, it tells you what’s missing instead of drafting around it.
- 03
It never applies a change silently.
A mapping it has learned from a past period arrives labelled with where it came from, and still waits for your sign-off.
- 04
It never trains on your figures or documents.
No model, ours or anyone else’s, learns from your ledger, your documents or what your team writes. What your team teaches it stays in your own project.
- 05
It never holds your data hostage.
On request, your records and audit trail as open files (JSONL and Parquet), with a SHA-256 manifest of every file, including on the way out.
Three-plane tenant isolation
Three planes. One of them is yours.
Every company runs in its own Google Cloud Project. Access is controlled through Google Cloud IAM and logged. Any attempt to reach another company’s project is refused.
- § 01No files or figures
Control plane
The central orchestration hub, in London.
// stores
account and audit records
Provisions and monitors each company’s project, and runs sign-in, onboarding, billing and administration. It keeps your account records and a copy of the audit record of actions on your records, never your files, figures or database.
- § 02Residency enforced
Embassy plane
Regional environments, one for each country.
// stores
stateless · transient
Anchors your data to the country you chose. Checks residency before any processing begins. The services here retain nothing outside your project.
- § 03Your project
Tenant plane
Your own Google Cloud Project.
// stores
your files, figures and database
Your database, your file storage, your search index and your audit trail live here, in a Google Cloud Project of your own. There is no path from one company’s project to another’s.
Stack · L1 → L7
What’s yours alone,
and what’s shared.
Your project, and the storage and database inside it, are yours alone. The app, the rules the AI follows, the search service and the AI models are shared services, run for every customer in your country, so each request carries only what it needs and your records stay in your project. The audit record of actions is kept in your project too, and a copy is held centrally, in London.
We’d rather show you the shared layers than blur them.
of 7 layers are yours alone. The app, the AI rules, the AI models, the search service and the cloud itself are shared services.
- L7ApplicationThe Struktürs app, run for your countryshared
- L6PolicyThe rules the AI follows, versionedshared
- L5AI modelsClaude · Gemini on Google Cloud, sent only what a question needsshared
- L4RetrievalA shared search service, reading an index kept in your projectshared
- L3StorageYour own storage and database, encrypted at restisolated
- L2ProjectYour own Google Cloud Project, in your countryisolated
- L1SubstrateGoogle Cloudshared
Regions & residency
Where your stack physically lives.
2 live · 3 committed
- UK GDPRlive
United Kingdom
Stored in London
- POPIAlive
South Africa
Stored in Johannesburg
- GDPRcommitted · see roadmap
European Union
Not open yet
- State privacy lawscommitted · see roadmap
United States
Not open yet
- PIPEDAcommitted · see roadmap
Canada
Not open yet
Audit · append-only trail
Every action on your records is on the record.
Actions on your records are recorded in an append-only audit trail. Each company has its own Google Cloud Project, storage and database. The trail is written to your own project, in your country. A copy is held centrally, in London, and that copy is what the audit log shows.
The trail is exportable (CSV or JSON) on request, for your auditor. If anyone tries to reach another company’s data, the attempt is refused.
Promises · in plain English
Six commitments. In plain English.
01 · Monitoring
We watch the service, not your data
You can’t run AI responsibly without watching it. We monitor errors, speed, cost and whether answers found their sources, so we spot problems before you do. Those records hold no figures, documents or names.
02 · Residency
Stored in your country
Your files, figures and database are stored in the country you choose at sign-up, and it can’t be changed later. Some processing happens elsewhere, and it’s listed in the answers at the top of this page.
03 · No standing access
Zero employee access by default
No one at Struktürs has standing access to your data. Infrastructure is defined in code and version-controlled. Emergency access is for one incident, time-limited and reviewed.
04 · Encryption
Encrypted at rest and in transit
Storage is encrypted under a key held for your country. It’s AES-256, one key for the country, shared by the companies there, not a key of your own. Your database uses Google Cloud’s standard encryption for now. Everything in transit is protected by TLS.
05 · Ownership
Your data, always
Everything you put in, and everything Struktürs produces for you, is yours, including after you leave. We’ll never sell it or use it for anything else.
06 · Reporting
Responsible disclosure
If you find a security vulnerability, email security@strukturs.ai. We’ll acknowledge it within 48 hours.
What it learns stays with you
It remembers the mappings your team confirms and indexes your past sessions so you can search them. Both are stored in your own project, in your country; the indexing itself runs in London. No model is trained on your data. The AI models that answer your questions run on Google Cloud, and where that’s outside your country, the answers at the top of this page say so.
Next
Questions about security?
Talk to us.
Your IT or security lead can email us directly, before or after you join.