Our security posture, in public

In short

Membership data lives on infrastructure that maintains SOC 2 Type II attestations, protected by application controls we describe below — plainly, so you can hold us to them. We run no third-party trackers, we name every subprocessor, and your membership file is yours to export at any time.

Audited infrastructure

Stoa runs on a small set of infrastructure providers, each of which maintains independent security attestations covering the services we build on. Your data is stored and processed on:

• ✓Supabase (database hosting) — SOC 2 Type II attested; data encrypted at rest, and our connections to it use strictly verified TLS.
• ✓Vercel (application hosting) — SOC 2 Type II attested and ISO 27001 certified.
• ✓Twilio SendGrid (email delivery) — SOC 2 Type II attested.
• ✓Apple and Google — wallet passes only, and only for members who add the card to a wallet.

Provider attestations cover their services; the application controls below are ours. Provider reports are available from each vendor’s own trust page.

Application controls

• ✓Every database table is protected by row-level security with deny-by-default privileges; the public data API roles are revoked outright.
• ✓Database connections verify TLS certificates strictly — no silent fallback to unverified transport.
• ✓Staff accounts are invite-only. Operator (support) access additionally requires multi-factor authentication, and operator actions are written to an audit log.
• ✓Every data path authorizes per organization — one museum’s staff can never read another museum’s roll.
• ✓Every server endpoint validates its input against a strict schema; a continuous-integration test fails the build if any endpoint ships without validation.
• ✓Sensitive paths — sign-in, staff PINs, door lookups, wallet endpoints, and demo requests — are rate limited.
• ✓Database schema changes are append-only and checksummed; an edited or missing migration fails the deployment.
• ✓Wallet-pass update endpoints authenticate every request with a per-pass token compared in constant time.
• ✓The site sends security headers (HSTS, content-type sniffing protection, frame denial) and makes zero third-party requests — no analytics, no ad pixels, no external fonts. What your members do on their card page is not shared with anyone.

Data lifecycle

• ✓You own your membership data and can export the full roll from the desk at any time — in via CSV, out via CSV.
• ✓A nightly retention sweep enforces documented windows: raw inbound email bodies are cleared after 30 days, processed inbound records after 180 days, outbound message logs after 400 days, and visit logs after two years.
• ✓Member deletion is real erasure: it also scrubs the member’s lines out of retained import files, not just the database row.
• ✓Organization offboarding removes the museum’s data in a single transaction — members, visits, messages, templates, staff, and wallet registrations.
• ✓Unsubscribes honor one-click (RFC 8058), feed a suppression list enforced on every send path, and survive re-imports.

Reporting a vulnerability

We want to hear about it, and we read every report. Email security@stoapass.com with enough detail to reproduce the issue. Please don’t access data that isn’t yours while testing; we won’t pursue good-faith research conducted within that line.

On SOC 2 for Stoa itself

Stoa itself is not independently SOC 2 audited. The infrastructure we run on (listed above) maintains its own SOC 2 Type II attestations. The application controls on this page are what we enforce today.

Related

Privacy covers what data we process and why. Terms covers the service agreement, including our site-content and anti-scraping policy.