This page explains how we protect Storage Studio and the data it handles, and how to tell us about a security problem. Storage Studio is sold by Techtonic Systems Media and Research LLC (Wyoming, USA) and developed and operated for it by DNS Stack Private Limited (India), whose team handles security reports.
What changed in this version
Version 2.0.1 (29 October 2026):
- Adds Trust and compliance: the ISO 9001:2015 and ISO 27001:2022 certificates held by DNS Stack Private Limited, Apple notarization, and Microsoft Store company verification.
- Reports now go to a dedicated address, <security@storagestudio.us>, the same one published in our security.txt file.
- Describes how licences and updates are signed today (Ed25519), how our websites refuse requests from other sites, how stored data is encrypted, and how Delta Trust and Storage Studio Bridge keep your content private.
- Adds Storage Studio Bridge, Delta Trust, Delta Drive and the website to what is in scope.
How we protect you
Licences and updates are signed. Licence tokens and the update information the app downloads are signed with Ed25519 keys. The app holds only the public keys, so it can check a signature but cannot make one. Older app versions used an earlier signing method, which we are retiring; those versions are asked to update.
Encryption in transit. Every connection between the app, the website and our servers uses HTTPS (TLS).
Encryption at rest. Our databases and stored files are encrypted at rest by our hosting providers. Details the app keeps on your Mac for connected cloud accounts and paired storage are stored in encrypted files on your Mac.
Delta Trust is end-to-end encrypted. Backups are encrypted on your Mac before they are uploaded, with a key derived from your 24-word recovery kit. We store only encrypted data and cannot read your backups. If you lose your recovery kit, your backups can never be recovered — not even by Storage Studio.
Locked folders. A folder you lock with a PIN can only be opened with that PIN, or with the recovery kit you chose to make for it. If you forget the PIN and have no recovery kit, the folder can never be opened again; Storage Studio can't recover it.
Storage Studio Bridge is end-to-end encrypted. Everything sent between your paired devices — clipboard, files and folders — is encrypted between the two devices. When a direct connection is not possible, traffic passes through a relay that forwards encrypted data it cannot read.
Our websites refuse requests from other sites. The admin console, the partner portal and the customer pages accept a change only when the browser shows it came from our own pages, so another website cannot act in your name. Sign-in uses one-time codes or links sent to your email; we do not store passwords for customers or partners.
Least access. Staff access to customer records is limited to people who need it, and administrative actions are recorded in an audit log.
One-time codes and credentials are never copied. Emails that carry a sign-in code, a link or a licence key are never copied to our internal mailboxes, and the code itself is not stored in our email records.
Trust and compliance
Certificates held by DNS Stack Private Limited, which develops Storage Studio (see the Terms of Service):
- ISO 9001:2015 (quality management system). Scope: providing IT services and software development solutions. Certificate QU-98567/0126, issued 13 January 2026, valid until 12 January 2029.
- ISO 27001:2022 (information security management system). Scope: providing IT services and software development solutions. Certificate IU-98963/0226, issued 20 February 2026, valid until 19 February 2029.
Both were issued by Revolutionary Certifications Services (RCS Cert, London) and are subject to yearly surveillance audits. You can check a certificate's status at <https://www.thesasl.co.uk/certified-clients/>.
Signed by Apple. Storage Studio for Mac is signed with an Apple Developer ID issued to Techtonic Systems Media and Research LLC and notarized by Apple, so macOS checks it before it first opens.
Verified by Microsoft. Techtonic Systems has completed Microsoft's company verification for the Microsoft Store.
These describe the companies and how the software is signed. They are not a guarantee about any particular use of the Services; see the Disclaimer.
How to report a vulnerability
Email <security@storagestudio.us> with "Security report" in the subject. Please include:
- A clear description of the problem and the impact you believe is possible.
- Step-by-step reproduction.
- The version of Storage Studio or Storage Studio Bridge you tested (Storage Studio: Settings → About), and your operating system and version.
- Whether you have told anyone else, and who.
We do not publish an encryption key for reports yet. If your report contains sensitive detail, send a short first message and we will agree a secure way to receive the rest.
What's in scope
- The Storage Studio app for macOS and its background service.
- Storage Studio Bridge on every platform we publish it for.
- The website and services at
storagestudio.usand its subdomains, including the API under/api/, the customer pages, the partner portal, Delta Trust, Delta Drive and its share links, and our Bridge relay.
What's out of scope
- Open-source components we ship (listed in our Third-Party Notices) — please report those to their maintainers too; tell us if Storage Studio is affected.
- The infrastructure of our service providers (for example Cloudflare, Stripe and Brevo) — please report to them directly.
- Social engineering of our staff or customers, physical attacks, and denial-of-service testing.
- Findings that need a device the attacker already fully controls, with no further impact.
What we ask
- Only access, change or delete data that is your own. If you reach someone else's data by accident, stop, don't keep it, and tell us.
- Don't run automated scanners or load tests against our services without asking first.
- Give us 90 days to fix the problem before you publish, or longer if we agree it is needed.
If you follow these rules in good faith, we will not take legal action against you for your research, and we will say so if anyone asks.
What you can expect
- Acknowledgement within 3 business days.
- An update within 14 days, and regular updates until the problem is fixed.
- A fix or mitigation as soon as it can be shipped safely.
- Credit in the release notes, if you want it.
We don't run a paid bug-bounty programme. For a valid, previously unknown report we may offer a free Lifetime licence and public thanks.
Contact
Security reports: <security@storagestudio.us>. Everything else: <support@storagestudio.us>.