Security

Infrastructure

storq.io is hosted on SOC 2 and ISO 27001 certified cloud infrastructure. All traffic is routed through a global CDN with built-in DDoS mitigation, caching, and automatic SSL certificate management.

Encryption

All data is encrypted in transit using TLS 1.2+ with strict transport security enforced across every connection. Data at rest - including databases and backups - is encrypted by our infrastructure providers.

Sensitive credentials and secrets are managed through environment-level encryption and are never stored in source code.

Authentication and access control

All passwords are securely hashed using industry-standard algorithms. Sessions automatically expire after a period of inactivity. Access is controlled through a role-based permission system, and all API access is authenticated via secure tokens.

Customer portal access is restricted to invited users only.

Payment security

storq.io never stores credit card information. All payment processing is handled by Stripe, a PCI DSS Level 1 certified payment processor. Card data goes directly to Stripe and never touches our systems.

Data isolation

Every storq.io account is fully isolated. All database queries and API requests are scoped to the authenticated account, ensuring your data is never accessible to another customer.

Application security

We enforce a strict Content Security Policy alongside additional security headers on every response. Dependencies are continuously monitored and patched for known vulnerabilities. All user input is validated and queries are parameterised to prevent injection attacks.

Data ownership and deletion

You own your data. Export everything at any time via CSV or API. If you cancel your account, all data is permanently deleted within 30 days.

Questions?

If you have security questions or need to report a vulnerability, contact us at [email protected].