Your Data Security is Our Priority
We are committed to protecting your data at every level. From encryption to infrastructure, security is built into every layer of Stora.
Security Features
Multiple layers of protection for your backup data.
Encryption at Rest
Backup content — your decrypted WhatsApp messages, media, and account archive — is stored unencrypted at the application layer; nothing about our design keeps that content unreadable by Stora, so we can read what we store. At-rest protection below the application layer is whatever Hetzner's German data-centre infrastructure provides. See our Privacy Policy for the full plaintext-custody disclosure.
Encryption in Transit
All data transfers use TLS 1.3, the latest transport layer security protocol, protecting your data as it moves between services.
Token Encryption
OAuth tokens are encrypted at rest using Fernet symmetric encryption (AES-128-CBC with HMAC), never stored in plaintext.
Secure Storage
Backup data is stored on dedicated storage infrastructure with redundancy and access controls. It is stored unencrypted by Stora at the application layer — see Encryption at Rest above.
Access Control
Each account's data is logically isolated at the database level and inaccessible to other accounts.
Audit Logging
A compliance audit log records account actions such as logins, sync events, and configuration changes.
Infrastructure
Built on trusted infrastructure with security at every layer.
-
Cloud Hosting
Application servers run on dedicated cloud infrastructure with high availability and low-latency access.
-
Dedicated Backup Storage
Backup files are stored on dedicated storage with redundancy to protect against data loss. Content itself is not encrypted by Stora — see the Encryption section above.
-
Employee Access Controls
Stora personnel with production access can read backed-up content, since it is stored unencrypted — this is a direct consequence of the plaintext-custody design, not a gap. Access is restricted to authorised personnel, protected by multi-factor authentication, and logged and auditable.
Compliance
Meeting the standards your business requires.
GDPR Compliant
We support data portability, the right to deletion, and provide a Data Processing Agreement (DPA) upon request.
SOC 2 Type II Planned
SOC 2 Type II certification is on our roadmap. We are building our processes and controls to meet these requirements.
Regular Security Audits
We conduct regular security audits of our infrastructure, codebase, and processes to identify and address potential vulnerabilities.
Responsible Disclosure
Found a vulnerability? We appreciate your help in keeping Stora and our customers safe. Please report security issues responsibly.
Start your secure backup today
Your data deserves enterprise-grade protection. Get started with Stora in minutes.