This page describes how your data is secured when using the cloud service, and the data storage options you have. The following deployment diagram shows details of the software architecture from a security perspective (hover your mouse over the highlighted elements and relationships). See Cloud Service - Software architecture for an overview of the software architecture.
User account information
Your password is stored using a one-way hashing algorithm, called bcrypt, with a random salt.
When purchasing a subscription via our website, we delegate the capture of payment information (i.e. credit card details) to Braintree Payments (a validated Level 1 PCI DSS compliant service provider) subsequently processes this information. For this reason, we do not store or have access to your credit card details.
There are a number of options for storing your workspace data (the JSON representation), each of which has a different balance between security and usability.
How is data stored by default?
Your workspace data is stored using AES encryption with a 128-bit key, a random salt and a passphrase that resides on the server. A small quantity of metadata (workspace name, description, low resolution thumbnails, etc) are stored unencrypted to make rendering your dashboard page easier, setting web page titles, etc.
For paid workspaces that are public or have the sharing link enabled, full resolution PNG versions of your software architecture diagrams are stored as public objects in Amazon Web Services S3. These are used for the image embed feature.
Can I encrypt my own data?
For additional peace of mind, we support client-side encryption on workspaces owned by a paid subscriber.
Can I use Structurizr without uploading my software architecture model to the cloud?
API keys and secrets
For cloud service workspaces (free and paid plans), your API key and secret pair is stored encrypted, with a random salt.
For cloud services workspaces with the sharing link enabled, the token used in workspace sharing links is also stored encrypted, with a random salt.
For cloud service workspaces with the Slack integration enabled, the token used in the request URL is also stored encrypted, with a random salt.
Structurizr is running in the US-East-1 region of Amazon Web Services, via Fargate and Elastic Container Service.
Your data is stored in Amazon RDS and S3, also hosted in the US-East-1 region.
All of your interactions with Structurizr (i.e. via the web browser and web API) are performed using HTTPS, with a CloudFlare Dedicated SSL Certificate.
We're only a small (two person) company, and we don't have the resources to complete all of the security/risk assessment questionnaires that we are sent, particularly by larger organisations. We have tried to include as much relevant information here but, if you do have a small number of specific questions after reading these pages, feel free to contact us.
For organisations concerned about the longevity of a small company and/or have data security concerns, we'd recommend using the on-premises installation. We have customers who have installed the on-premises installation on their own servers, and on the AWS/Azure clouds. On-premises subscriptions include perpetual usage, so you'll be able to continue using the on-premises installation, although you'll only receive support and updates with an active subscription. Alternatively, you may want to look at Structurizr Lite, and the open source Structurizr ecosystem has a number of other diagram rendering options.
Section 889 and "covered technology" compliance
While we have not (and will not) knowingly use any covered technology in the delivery of our service/product, (1) we're only a small company and (2) we use a large number of open source libraries, so it's impractical for us to verify our entire supply chain. For this reason, we unfortunately cannot sign any section 889 compliance forms.