Security

Storafleet is a management layer for S3 — which means we are trusted with credentials that can read, write and delete your object storage. We take that responsibility seriously. This page explains how we protect your data, what we collect, and how to report a vulnerability.

1. The threat model we care about

The single most important thing we protect is your S3 access keys. Everything in our design stems from the assumption that a key leak would be catastrophic for our customers, even if the rest of Storafleet were fine.

2. How credentials are stored

• S3 access keys are encrypted at the application layer using AES-256-GCM before they touch the database. The encryption key lives in a secrets manager (not in the database), rotated periodically.
• Credentials are decrypted only in memory at the moment of an AWS API call, and never logged, serialised into error messages, or written to disk.
• We do not synchronise or replicate credentials to a third-party service. They live only in our Mumbai region database.

3. Payment security

All payment information is handled directly by Razorpay, a PCI-DSS Level 1 processor. Storafleet servers never see or store your card, UPI, or bank details — we receive only the Razorpay payment/order IDs and the amount.

4. Transport security

• All traffic to storafleet.com is served over HTTPS (TLS 1.2+).
• HSTS enabled on the marketing domain.
• Mixed content is blocked. Certificates are managed by our edge provider and rotated automatically.

5. Authentication

• Passwords are hashed with bcrypt (cost factor 12). We never store plaintext passwords.
• JWT access tokens are short-lived (15 min) and paired with refresh tokens that rotate on use.
• Two-factor authentication is on our 2026 roadmap and will be offered for super admin accounts first.

6. Application security

• Input validation with Joi on every admin-facing route.
• Rate limiting on authentication and webhook endpoints.
• Append-only audit log for every super admin action — cannot be mutated from application code (enforced at the ORM layer).
• Razorpay webhook signatures are verified before touching any database state.

7. Infrastructure

• Hosted in AWS ap-south-1 (Mumbai). Backups are encrypted and retained in the same region.
• Database access is restricted to application servers via private subnets and SG rules.
• Routine patching of OS and runtime images.

8. Reporting a vulnerability

If you believe you have found a security issue, please email security@storafleet.com with reproduction steps. We acknowledge responsible disclosures within 72 hours and aim to fix critical issues within 7 days. We do not yet have a formal bug-bounty program but we will recognise researchers in release notes and are happy to provide a letter of appreciation.