Last updated: 24 September 2026
Security is an important part of how Straduct is designed, developed and operated.
Straduct processes business intelligence, research, workspace information and, depending on the feature being used, personal data. We therefore aim to apply technical and organisational safeguards appropriate to the nature of the information and the risks involved.
This page provides a high-level overview of our security approach without disclosing information that could weaken the security of the platform.
Our security approach is guided by principles including:
Straduct uses authenticated user accounts to control access to the application.
Users are responsible for protecting their credentials and ensuring that access to their account is not shared with unauthorised persons.
Workspace administrators may have additional responsibilities for managing workspace membership, permissions and configuration.
Straduct may introduce or expand additional authentication and account-security controls as the platform develops.
Access to systems and information should be limited to users, services and personnel that require access for legitimate operational purposes.
Administrative or privileged access should be restricted and separated from ordinary user access where appropriate.
Access permissions may be reviewed or revoked when they are no longer required.
Straduct is designed as a multi-tenant platform.
Application and database controls are designed to prevent one customer workspace from accessing information belonging to another workspace without authorisation.
Tenant isolation is considered in application queries, permissions and data-access controls throughout the platform.
Straduct uses established cloud and infrastructure providers to operate different parts of the service.
Current providers include infrastructure used for application hosting, databases, website hosting, email delivery and AI-assisted functionality.
Information about relevant providers is available on our Data Processing & Subprocessors page.
Straduct's public website and application are intended to use secure HTTPS/TLS connections for information transmitted between users and Straduct services.
External service integrations are also expected to use secure communication mechanisms appropriate to the provider and service involved.
Straduct relies on managed infrastructure providers for database and storage functionality.
Storage security includes provider-level protections together with Straduct application-level access controls and tenant restrictions.
We aim to avoid storing information that is not reasonably necessary for the relevant service or operational purpose.
Application secrets, API credentials and service credentials should not be embedded in public client-side code or exposed to unauthorised users.
Sensitive configuration values are intended to be managed through appropriate server-side or infrastructure configuration mechanisms.
Credentials should be rotated, replaced or revoked where compromise is suspected or where operational requirements make this appropriate.
Security is considered throughout Straduct's application development process.
Relevant areas include:
Database access is intended to be restricted according to application requirements and authorised roles.
Where supported by the platform architecture, row-level and tenant-aware access controls may be used to limit access to information belonging to the relevant user or workspace.
Certain Straduct features may transmit selected information to external AI providers in order to perform requested research or analysis.
Straduct aims to send only information reasonably required to perform the relevant function.
Users should avoid placing passwords, authentication secrets or unnecessary sensitive information into AI-assisted features.
Further information is available in our AI & Human Review Policy.
Straduct may maintain technical, application and security-related records required to operate, troubleshoot and protect the platform.
These records may include authentication activity, system events, application errors and other operational information.
Logging should be limited to information reasonably required for legitimate operational and security purposes.
Straduct aims to investigate suspected security incidents and take appropriate steps to contain, understand and remediate confirmed issues.
Where an incident involves personal data, applicable data protection notification and communication requirements will be considered.
Response actions may include:
Straduct uses managed infrastructure providers designed to provide reliable cloud-based services.
We aim to design the application so that failures can be identified and addressed without exposing unrelated customer information.
No online service can guarantee uninterrupted availability.
Maintenance, provider outages, network failures, security incidents and other events may occasionally affect availability.
Straduct includes processes intended to support account and personal-data deletion where legally applicable.
Deletion may remain subject to limited retention required for legal, accounting, fraud-prevention, security, backup or dispute-resolution purposes.
Privacy rights and deletion requests are described in our Privacy Notice.
Straduct depends on external providers for parts of its infrastructure and services.
We aim to select providers appropriate to the function they perform and to consider their security and data-protection arrangements where relevant.
A current high-level provider list is available on our Data Processing & Subprocessors page.
Security is shared between Straduct and its users.
Customers and users should:
If you believe you have identified a security vulnerability affecting Straduct, please report it responsibly to:
Please include, where possible:
Please do not intentionally access, alter, delete or expose information belonging to other users while investigating a suspected vulnerability.
Please do not conduct denial-of-service testing, destructive testing, social engineering or other activity that could impair the service or affect other users.
Straduct will only claim specific security certifications, independent audit results or compliance attestations where those claims are current and can be substantiated.
The absence of a certification claim on this page should not be interpreted as a representation that a particular certification has been obtained.
Security requirements change as technology, threats, features and regulatory expectations evolve.
Straduct may update its security controls, development practices, infrastructure or service providers as the platform develops.
This page may be updated to reflect material changes to our security approach.
Security questions or vulnerability reports may be sent to:
Straduct
Email:
support@straduct.com
Website:
straduct.com