Security at STOKROOM

This page is maintained by STOKROOM to answer common security and privacy questions about the Service. It is not an independent certification.

Encryption

All traffic between your browser and STOKROOM is encrypted in transit using TLS 1.2 or higher. Customer Data is stored in a managed database with encryption at rest.

Authentication and access

• Email and password sign-in with bcrypt-hashed credentials, plus Google OAuth.
• Role-based access controls (owner, admin, member) enforced per workspace.
• Row-level security policies on the database ensure users only ever see data from workspaces they belong to.

Infrastructure

STOKROOM runs on managed cloud infrastructure with automated patching, network isolation, and least-privilege service credentials. Backups run on a rolling daily schedule.

Application security

• Dependency and vulnerability scanning on every deploy.
• Server-only handling of secret keys — never shipped in the browser bundle.
• Input validation on every server function; audit log for sensitive actions.

Responsible disclosure

If you think you have found a vulnerability, please email security@stokroom.io with steps to reproduce. We aim to acknowledge reports within two business days and will credit you once the issue is fixed if you would like.

Data export and deletion

You can export your workspace at any time from settings and request full deletion by emailing privacy@stokroom.io.