Security and data handling
This page is a source-backed draft for security, operations, and legal review. It must be reviewed before it is used as a final security commitment.
This page summarizes how Stally currently protects customer access and processes security reports.
Authentication
Stally uses AWS Cognito for customer authentication. The application verifies signed authentication tokens before granting access to non-public dashboard routes.
The current documentation does not claim that multi-factor authentication is required or that a specific password policy applies.
Customer isolation
Stally logically scopes customer records using the authenticated user profile and ownership identifiers. Authorization checks are applied when users access domains, documents, videos, and account evidence.
Customer data is stored in shared application infrastructure. Stally does not claim physically separate databases, buckets, or cryptographic environments for each customer.
Encryption and transport
The production dashboard and configured production service endpoints use HTTPS to protect data in transit.
Specific encryption-at-rest algorithms, key ownership, TLS versions, and cipher requirements are still under infrastructure review and are not asserted by this draft.
Hosting and service providers
Stally uses Cloudflare infrastructure, PostgreSQL storage, AWS Cognito, and other service providers. Purchasing Stally through AWS Marketplace does not mean the entire Stally application is hosted on AWS.
See the privacy policy draft for the categories of information and service providers currently identified in the implementation.
Activity records
Stally records selected product and account activity, including domain, scan, declaration, document, audit, and AWS Marketplace entitlement events.
These records are not currently described as a comprehensive security audit log. One-year retention and tamper-protection controls require operational verification before they can be stated as guarantees.
Report a security issue
Email [email protected] with the subject Security report.
Include:
- A description of the suspected issue
- The affected Stally feature or URL
- The date and time observed
- Reproduction steps that do not expose another customer's data
- The potential impact
- Your preferred contact details
Do not include passwords, API keys, session cookies, AWS credentials, exploit payloads containing personal data, or confidential customer content in the initial email. The Stally team can provide an appropriate transfer method if additional evidence is required.
What happens after a report
The Stally team reviews the report, may request additional information, and prioritizes remediation according to the assessed impact. If a confirmed security incident is relevant to customers, Stally will notify affected customers using available account contact information and provide known impact and recommended actions.
Acknowledgement targets, severity levels, notification timeframes, and escalation procedures still require formal approval.
Customer responsibilities
Customers should protect account credentials, restrict access to authorized users, keep contact details current, and report suspected unauthorized access promptly.