Our security posture, in public

In short

Membership data lives on infrastructure that maintains SOC 2 Type II attestations, protected by application controls we describe below — plainly, so you can hold us to them. We run no third-party trackers, we name every subprocessor, and your membership file is yours to export at any time.

Audited infrastructure

Stoa runs on a small set of infrastructure providers, each of which maintains independent security attestations covering the services we build on. Your data is stored and processed on:

• ✓Supabase (database hosting) — SOC 2 Type II attested; data encrypted at rest, and our connections to it use strictly verified TLS.
• ✓Vercel (application hosting) — SOC 2 Type II attested and ISO 27001 certified.
• ✓Twilio SendGrid (email delivery) — SOC 2 Type II attested.
• ✓Apple and Google — wallet passes only, and only for members who add the card to a wallet.

Provider attestations cover their services; the application controls below are ours. Provider reports are available from each vendor’s own trust page.

Application controls

• ✓Every database table is protected by row-level security with deny-by-default privileges; the public data API roles are revoked outright.
• ✓Database connections verify TLS certificates strictly — no silent fallback to unverified transport.
• ✓Staff accounts are invite-only. Operator (support) access additionally requires multi-factor authentication, and operator actions are written to an audit log.
• ✓Every data path authorizes per organization — one museum’s staff can never read another museum’s roll.
• ✓Every server endpoint validates its input against a strict schema; a continuous-integration test fails the build if any endpoint ships without validation.
• ✓Sensitive paths — sign-in, staff PINs, door lookups, wallet endpoints — are rate limited.
• ✓Database schema changes are append-only and checksummed; an edited or missing migration fails the deployment.
• ✓Wallet-pass update endpoints authenticate every request with a per-pass token compared in constant time.
• ✓The site sends security headers (HSTS, content-type sniffing protection, frame denial) and makes zero third-party requests — no analytics, no ad pixels, no external fonts. What your members do on their card page is not shared with anyone.

Data lifecycle

• ✓You own your membership data and can export the full roll from the desk at any time — in via CSV, out via CSV.
• ✓A nightly retention sweep enforces documented windows: raw inbound email bodies are cleared after 30 days, processed inbound records after 180 days, outbound message logs after 400 days, and visit logs after two years.
• ✓Member deletion is real erasure: it also scrubs the member’s lines out of retained import files, not just the database row.
• ✓Organization offboarding removes the museum’s data in a single transaction — members, visits, messages, templates, staff, and wallet registrations.
• ✓Unsubscribes honor one-click (RFC 8058), feed a suppression list enforced on every send path, and survive re-imports.

Reporting a vulnerability

We want to hear about it, and we read every report. Email cards@xstudioworks.com with enough detail to reproduce the issue. Machine-readable details live at /.well-known/security.txt. Please don’t access data that isn’t yours while testing; we won’t pursue good-faith research conducted within that line.

On SOC 2 for Stoa itself

Stoa is not yet independently audited. Our position is transparency first: this page states what a SOC 2 report would attest, in public, and the technical controls above are built and enforced today. We will begin a SOC 2 Type II audit alongside our first enterprise agreement that requires one, and the report will be available under NDA. Until then, we are glad to complete your security questionnaire — most answers are already on this page.

Related

Privacy covers what data we process and why. Terms covers the service agreement, including our site-content and anti-scraping policy.