Structa AI · launch readiness

Permissions and access controls

Operational draft · Effective August 18, 2026 · Last updated August 18, 2026

These pages reflect the current product implementation and the supplied operator, contact, and refund decisions. Governing law, retention periods, final pricing/tax treatment, and final legal approval must still be confirmed before formal production launch.

Structa AI uses least-privilege browser and server controls so construction business data stays scoped to the right user and company workspace.

Browser permissions

Denied by default

Camera, microphone, geolocation, payment request APIs, USB, Bluetooth, accelerometer, gyroscope, and magnetometer access are not required by the current product.

Network boundaries

Content Security Policy limits scripts, forms, frames, and network calls to approved origins. The app cannot be embedded by another site.

Application access levels

Anonymous visitors can request a limited project snapshot only.
Authenticated users can access their own account and companies.
Company projects, analyses, and dashboard reads require verified membership in that company.
Paid proposal and team features require an eligible subscription plan.
Admin metrics and operational views require an authorized admin email.
Billing checkout and subscription actions require authentication; payment state changes come from signed, idempotent Creem webhooks.

Security controls

Production responses use HSTS, CSP, frame denial, MIME sniffing protection, strict referrer policy, cross-origin isolation headers, HttpOnly sessions, same-origin mutation checks, request size limits, server-side quotas, and structured request IDs for support diagnostics.

Review before launch

Confirm the final admin email list, support contact, legal entity, retention schedule, staff access policy, and incident process before production traffic is enabled.