Security

SkyStruct provides construction-project software for teams that exchange documents, drawings, instructions and commercial records. Protecting that information requires both platform safeguards and careful control of how each customer configures and uses its workspace. This page describes our security approach. Contractual controls are set out in the DPA and the agreed deployment and service schedules.

1. Access and confidentiality

Access should follow an individual's role and legitimate project responsibilities. Customer administrators are responsible for approving invitations, assigning permissions and removing access when a person's role ends. Each user must have individually assigned credentials; a concurrent licence does not permit password sharing.

SkyStruct's access to Customer Data is limited to authorised personnel and approved providers who need it to deliver, secure or support the service. Those persons must be subject to confidentiality duties. The technical measures governing administrative access are specified in the DPA's security schedule. Customer-facing authentication options, including any single sign-on or multi-factor functionality, must be confirmed for the selected product and deployment rather than assumed to be available in every configuration.

2. Protection of information

Our security commitments require safeguards proportionate to the information processed and the risks involved, including protection against unauthorised access, disclosure, alteration, loss and destruction. For environments we operate, the DPA specifies the applicable access, encryption, segregation, logging and recovery controls.

Security depends on the full path taken by information. A document exported to a personal device, shared through an external application or sent to a project participant is subject to the controls of that destination. Customers should minimise sensitive information, review external sharing and protect downloaded records.

3. Hosting and deployment responsibilities

The location of production systems, backups, logs and any remote support access must be established for the relevant deployment. A Qatar-based supplier does not, by itself, mean that every service component or support activity takes place only in Qatar. A Qatar-only or other restricted-residency requirement must be explicitly included in the accepted deployment schedule and implemented across all relevant processing activities.

For a SkyStruct-managed cloud service, SkyStruct is responsible for the components it operates. For customer-managed or on-premises systems, the customer is responsible for its infrastructure, networks, devices and recovery arrangements unless those services are expressly assigned to SkyStruct. We remain responsible for our application services and any Customer Data we access or hold. Responsibility must not be assumed merely from the name of a deployment model.

4. Operational security and recovery

Our contractual security requirements address controlled administrative access, security-relevant logging, managed changes, vulnerability handling and incident response. Testing and remediation should be proportionate to the risk and the service boundary. A particular certification, testing frequency or monitoring service is not implied unless supported by the applicable evidence and agreement.

Backup scope, retention and restoration arrangements are agreed for the deployment. An uptime commitment is not the same as a recovery-time or recovery-point commitment. Customer-specific recovery targets, enhanced disaster recovery, immutable storage and long-term archives apply only where expressly contracted. Backups do not replace a customer's responsibility to retain records required beyond the subscription term.

5. Integrations, AI and sensitive information

Customer-selected integrations can send information outside the SkyStruct environment. Administrators should authorise only the data exchange necessary for the agreed purpose and assess the receiving provider. Providers appointed by SkyStruct to process personal data are handled under the DPA's subprocessor provisions.

Before enabling an AI feature that sends Customer Data to an external provider, its purpose, provider, processing locations and retention arrangements must be agreed. The Terms restrict unrelated use of Customer Data for advertising or model training. AI output must be reviewed by an appropriately qualified person before it is used for a consequential project decision.

Do not upload regulated or sensitive material merely because the platform offers document storage. Special-nature personal data, health records and information about children require prior agreement and any necessary legal permissions.

6. Report a security concern

Send a suspected security issue to info@skystruct.com with the subject “Security incident” or “Security vulnerability”. Identify the affected service, approximate time, nature of the issue and a safe way to contact you. Do not include passwords, authentication tokens, private keys or unnecessary personal data in an ordinary email. We can arrange an appropriate channel for sensitive evidence.

Stop any activity that risks affecting another customer's information. Do not access, copy, change or delete records beyond what is necessary to recognise an issue; do not attempt denial-of-service testing, social engineering or further exploitation without written authorisation. This page is not a public bug-bounty offer or legal authorisation to test.

We will assess reports, take appropriate protective action and make notifications required by the DPA and applicable law. A report is not required to contain a completed investigation before being sent. Contracted incident-notification duties are separate from ordinary customer-support hours.

7. Further information

Our Security & Trust page explains the contractual documents and due-diligence information available for procurement reviews. No security measure makes a service risk-free. That limitation does not reduce SkyStruct's agreed duties of care, confidentiality, security or incident response.