[00 / TRUST]
Your contracts are confidential. The system is built that way.
Vendor agreements contain pricing, liability positions and personal data. This page lists the controls that protect them, in the same terms we use in security questionnaires.
[01 / CONTROLS]
Control ledger
SEC-01
Zero data training
StrucPact calls the Anthropic Claude API under commercial API terms. Under those terms, inputs and outputs sent through the API are not used to train Anthropic models. LaunchStruc LLC does not train or fine-tune any model on customer contracts, playbooks or findings, and does not permit any sub-processor to do so.
SEC-02
Encryption in transit
All connections between your browser or integration and StrucPact, and between StrucPact and its sub-processors, use TLS 1.3. Plaintext HTTP is redirected and HSTS is enabled.
SEC-03
Encryption at rest
Stored documents, playbooks and findings are encrypted at rest with AES-256. Encryption keys are managed by the underlying cloud provider's key management service and are separated from application data.
SEC-04
Role-based access control
Access to documents and playbooks is granted by role: Administrator, Playbook Author, Reviewer and Read-only. Roles are scoped to a workspace, and a user sees only the workspaces they belong to. Inside LaunchStruc LLC, production data access is limited to named engineers with a documented need.
SEC-05
Audit logging
Uploads, playbook edits, role changes, exports and sign-ins are written to an append-only audit log with actor, timestamp and object. Administrators can view the log in the product. Retention is 90 days on Growth and one year on Scale; Enterprise retention is set by contract.
SEC-06
Data lifecycle
Customers can delete a document at any time. On account termination, customer data is deleted within the period set out in the Data Processing Addendum. Prompts sent to the model are assembled per request and are not stored by StrucPact beyond the finding record you see in the product.
[02 / SUB-PROCESSORS]
Sub-processor ledger
Every third party that may process customer data on our behalf. Customers on a Data Processing Addendum receive 30 days' notice before we add one.
| Sub-processor | Purpose | Customer data involved | Location |
|---|---|---|---|
| Anthropic PBC | Large language model inference through the first-party Claude API | Contract text, playbook rules, generated findings | United States |
| Vercel Inc. | Application hosting, edge delivery and serverless execution | Request metadata, session data, application logs | United States |
| Amazon Web Services, Inc. (AWS) | Encrypted object and database storage | Stored documents, playbooks, findings, audit logs | United States (US-East) |
[03 / GOVERNANCE]
Reporting and reviews
Report a suspected vulnerability or incident to [email protected]. We acknowledge reports on the next business day and notify affected customers of a confirmed personal data breach without undue delay, as set out in the Data Processing Addendum.
Enterprise customers can request a security review call, our completed vendor questionnaire and a walk through of the architecture. LaunchStruc LLC does not currently hold third-party security certifications and does not claim any.
Request a security review