Encryption
All endpoints require TLS 1.2 or newer; TLS 1.3 is preferred. Data at rest is encrypted with AES-256-GCM using per-bucket data keys, which are wrapped by master keys held in hardware security modules and rotated yearly.
Security
Security is part of the storage contract
Your data is only useful if it stays intact, available and private. This page describes the controls we operate and how to report a vulnerability.
Access & identity
Console access supports SSO through SAML 2.0 and OIDC, with enforced multi-factor authentication. Workspaces can require SSO for every member.
Isolation
Customer data is logically isolated per workspace and bucket. Storage nodes run a minimal hardened image, and administrative access requires hardware keys and a just-in-time approval.
Audit logging
Every management action is recorded with actor, source and result, retained for 400 days and exportable through the API.
Secure development
Changes require peer review and pass static analysis and dependency scanning. Production deploys are reproducible and signed.
Privacy & GDPR
We act as a processor for customer data and offer a data processing agreement. Data stays in the regions you choose unless you configure replication.
Vulnerability disclosure
Report a vulnerability
Email security@tcnstorage.store with a description, reproduction steps and the affected hostnames. Our machine-readable contact details are published in security.txt.
- We acknowledge reports within two business days and share a remediation timeline within ten.
- We will not pursue legal action for good-faith research that respects customer data, avoids service degradation and follows this policy.
- Do not access, modify or delete data you do not own. Use your own workspace for testing.
- Denial-of-service testing, social engineering and physical attacks are out of scope.
Abuse reports — content hosted by a customer that violates our acceptable use policy can be reported to abuse@tcnstorage.store.