Security
Security and data handling.
Where your information is kept, how it is protected, and who can see it.
The facts
One firm, one cloud provider, one person with access.
Questions about security: contact@strature.net. To report a vulnerability, see security.txt.
- Hosting
- The site runs on Microsoft Azure Static Web Apps. Its form service runs in Azure’s East US 2 region (United States).
- Storage
- Requests, their records and the full briefs are stored in Strature’s own Azure storage in the Canada Central region. Emails are sent through Azure Communication Services, with its data kept in Canada, and received in the firm’s own Microsoft 365 mailbox.
- In transit
- HTTPS only. Browsers are told to use HTTPS for a year (HSTS). Storage accepts only encrypted connections, TLS 1.2 or later. Only the site’s own scripts can run on its pages.
- At rest
- Stored data is encrypted by Azure, with keys managed by Microsoft.
- Full briefs
- Kept in private storage. Sent only to a confirmed work email: a single-use link valid for 24 hours, then download links valid for 15 minutes each, at most five within 48 hours.
- Access
- Only the Principal has access to Strature’s Azure account, as its owner. No other person has a role in it. He is the only Microsoft 365 user, so only he can read requests and email. Administrative accounts use multi-factor authentication.
- Visits
- No tracking of people. We count visits and downloads, without cookies.
- Retention
- Requests are kept for 24 months from your last request, then deleted. On request, we delete your details within 30 days, unless the law requires us to keep them.
- Breach notice
- If a breach involving personal information creates a real risk of significant harm, we report it to the Office of the Privacy Commissioner of Canada and, for people in Quebec, to the Commission d’accès à l’information, and we notify the people affected as soon as we can. We keep a record of every breach.
- Agreement
- A data processing agreement can be put in place on request. See also the privacy policy and the sanctions statement.