Security and Trust

Trust in a construction platform depends on clear responsibility, controlled information sharing and commitments that can be examined. SkyStruct QSTP-LLC provides a contractual framework for customers to assess how the proposed service will handle their information, support their operating requirements and assist with their data-protection responsibilities.

1. Clear ownership and permitted use

Customer project records remain subject to the rights of the customer and the organisations or individuals that own them. SkyStruct receives only the rights needed to deliver the contracted service. Our Terms address confidentiality and restrict unrelated advertising, sale of Customer Data and model training. Project access permissions do not transfer intellectual-property ownership.

2. Responsibilities documented for your deployment

Before agreeing a deployment, the parties should identify the service boundary, data locations, permitted support access, integrations and operational responsibilities. Cloud, dedicated and customer-managed deployments can involve different allocations. A requirement such as Qatar-only processing, enhanced recovery or an external integration must be specified and agreed; it is not created by a general marketing description.

The Security page describes operational safeguards. The DPA and its schedules record enforceable processing obligations, authorised providers, locations, security measures and exit arrangements. The Terms and any agreed SLA address service availability and remedies. These documents should be read together rather than treating an uptime percentage as a complete security assurance.

3. Qatar and regional data-protection requirements

Our Data Protection page explains Qatar's local framework and the circumstances in which additional laws, including GDPR, may apply. Legal requirements are assessed for the particular customer and processing activity. We do not present GDPR as Qatar law or make an unrestricted claim of compliance with every Middle Eastern jurisdiction.

Customers remain responsible for their project governance, lawful instructions and the information they choose to collect. SkyStruct remains responsible for the obligations applicable to its own role. Software features assist governance; they do not replace a customer's statutory duties or professional judgement.

4. Procurement and security due diligence

For a proposed or contracted service, customers may request information relevant to their assessment, including the DPA, deployment responsibilities, processing locations, the applicable subprocessor register, security-control descriptions, agreed recovery arrangements and the applicable service-level terms. We will identify what is available and what requires customer-specific confirmation rather than imply that every requested report or certification exists.

Sensitive architecture, assessment findings and operational detail may be shared under suitable confidentiality arrangements and access restrictions. Those arrangements must not prevent mandatory regulatory access or the exercise of audit rights under the DPA. A request for evidence does not itself change the contracted service scope.

5. Certifications and assurance statements

A certification, audit report or regulatory approval should be relied on only where SkyStruct provides current evidence identifying the legal entity, service boundary, standard, validity period and material exclusions. A hosting provider's certification does not automatically certify SkyStruct's application or operating processes. Only an assurance expressly identified and supported by current evidence should be treated as a SkyStruct certification, audit or accreditation claim.

6. Responsible use and continuing accountability

Administrators should keep invitations, permissions, sharing settings and retention needs under review as projects and personnel change. AI-generated content and automated workflow results require appropriate human oversight. Security incidents and privacy concerns are handled through the obligations in the DPA and applicable law, not solely through ordinary helpdesk priorities.

End-of-service arrangements should be agreed before important records are entrusted to the platform. Customers can request their data in accordance with the Terms and DPA; access, exports, archives and deletion have distinct purposes and timeframes.

7. Contact and related documents

For procurement or trust enquiries, email info@skystruct.com with the subject “Security and trust review”. For a suspected incident, use “Security incident”; for a privacy request, use “Data protection request”. Include your organisation and the relevant deployment or account without sending unnecessary confidential material.

Related documents: Terms of Service; Subscription and Cancellation Policy; Security; Data Protection: Qatar, the Region and GDPR; Data Processing Addendum; and the existing Privacy Policy. An Order or DPA may identify additional customer-specific schedules. This page is an explanatory overview and does not replace those documents or expand an agreed certification, service level or hosting commitment.