Connect your sources
Files remain in their original repositories. Provider credentials and OAuth grants determine what a connector can access.
Start here
Security at a glance
A practical starting point for IT, security and procurement teams. Review the controls together with your selected configuration and service agreement.
Source filesStay in connected cloud and SaaS repositories. Indexing
processes selected content.
Search indexStores derived text, metadata and vector embeddings.
Customer-hosted storage is available where enabled.
Access modelOrganization roles and configured connection and folder
permissions govern retrieval.
External AIAuthorized results and document content may be sent to
connected AI providers.
Security review contact: info@storagechain.io · Source: byoc.storagechain.io/security
01 / Data handling
Know where your data goes.
Connect existing repositories without migrating original files. Choose the sources and supported indexing scopes that fit your organization.
Build a searchable index
Selected content is processed into text, metadata and vector embeddings, retained for search and retrieval.
Retrieve with permission
Membership and configured source permissions determine accessible results and content.
Original files in your cloud does not mean zero data processing. Search retains a derived index. Connected AI tools can receive authorized content. Include index location, processing and AI provider retention in your data governance review.
02 / Access & permissions
Give each person the right access.
Backend checks enforce organization membership, roles and configured source access. Owners and admins should review permissions when inviting people or connecting repositories.
| Role | Scope of access |
|---|---|
| Owner | Organization-wide access, with owner-only controls including customer-hosted search storage setup. |
| Admin | Broad organization and connection access to manage the workspace. |
| Member | Assigned connection permissions and configured folder or resource restrictions. |
Scope each source
Configure connections, buckets, folders or provider resources where supported.
Separate actions
Configure viewing, uploading, deleting and sharing permissions as needed.
Recheck AI retrieval
MCP candidates receive additional membership, connection and file-scope checks.
Restrictions must be configured. Provider-side permission changes can depend on connector synchronization and provider checks. Do not assume all source changes propagate instantly.
03 / Encryption & keys
Encrypted credentials. Controlled use.
Cloud access keys and OAuth access and refresh tokens are encrypted before database storage. Normal connection responses omit credential fields.
AES-256-GCM provides encryption with integrity protection.
- Random initialization values and authentication tags
- Tamper detection on encrypted credential data
- Decryption by the backend for authorized provider operations
Organization-scoped credentials use organization keys wrapped by a master key.
- Some OAuth flows use the configured master key directly
- AWS Secrets Manager integration
- Optional AWS KMS, depending on deployment
Server-side protection: the service must be able to decrypt authorized credentials to contact your providers. This credential encryption statement does not establish encryption at rest for every data store.
04 / Account protection
Protect your account and browser session.
Account and session controls work alongside organization permissions. Turn on two-factor authentication for an additional layer at password sign-in.
Enable authenticator 2FA
Use a standard authenticator app and a six-digit code. Single-use backup codes are stored hashed; keep your copies somewhere safe.
Open security settingsPasswords & recovery
Passwords use bcrypt. Reset tokens are hashed, expire after 10 minutes and are cleared after successful reset. Rate limits protect sign-in and recovery.
Browser sessions
HttpOnly session cookies, production Secure defaults and CSRF protection for cookie-authenticated changes.
Browser safeguards
Content Security Policy, anti-framing controls, content-type sniffing protection and restricted browser permissions.
Document previews
Authenticated, app-hosted PDF and Office preview components avoid the need for a public third-party viewer.
Telemetry & audit
Search telemetry has field length limits and recognized credential pattern redaction. Query logs have configurable expiry with a 30-day default. Membership removal, restoration and folder-share changes retain actor and organization context.
05 / AI & API access
Connect AI with deliberate authorization.
MCP connector grants and API keys have their own authentication controls. Review them separately from password sign-in and 2FA.
Users sign in and approve a grant tied to a selected organization and read-only knowledge scope.
- OAuth with PKCE S256
- Registered redirect URI validation
- Expiring access tokens and rotating refresh tokens
- Refresh-token reuse detection revokes grants
Configure permissions and optional expiration for each integration.
- Cryptographically random keys
- SHA-256 hashes used for verification
- Active and expiry checks during authentication
- Last-used tracking
Review the connected AI provider too. Authorized search results and document content can be shared with an external AI service. Its handling, storage and retention terms apply alongside StorageChain access controls.
06 / Self-hosted search
Choose where your search index lives.
Where enabled, an organization owner can connect a customer-hosted search node. After activation, indexed text, metadata and vector embeddings use that infrastructure.
| Review area | Managed search storage | Customer-hosted search storage |
|---|---|---|
| Index location | Managed search infrastructure. | Your linked search node after activation. |
| Access path | Protected through the application. | Authenticated gateway over validated HTTPS/TLS. No direct browser-to-database connection. |
| Node availability | Managed search service availability. | Search reads and writes fail if the active node is unavailable; no silent switch back to managed storage. |
| Operations | Confirm deployment responsibilities during review. | You manage disks, network restrictions, server access, updates, monitoring and backups. |
| Data migration | Existing managed index remains until migration and removal are completed. | Connecting a node does not automatically migrate or delete the managed copy. |
Review pairing, node access and migration controls
- Owner-only setup: pairing uses a single-use server code with a 15-minute expiry.
- Scoped node access: signed tokens expire after 5 minutes and are scoped to node, organization, partition and operation. Source and member permissions still apply.
- Gateway protection: endpoint validation, TLS certificate and hostname validation, and an authenticated gateway rather than exposed database ports.
- Migration verification: reports compare expected and copied files, content mismatches, permission failures and reprocessing. Review results before removing the old managed copy.
- At-rest encryption: encryption of customer-hosted disks and storage depends on your infrastructure configuration.
Self-hosted search is not the entire service. Processing, authentication, other service data and temporary encrypted delivery buffers may still use StorageChain infrastructure. External AI tools can still receive authorized content. Migration and managed-copy removal are separate steps.
Inspect the system architectureIdentity, permissions, storage, search and provider
services.
Open full diagram
07 / Compliance review
Make your security review straightforward.
Use this page to identify relevant controls, then request current evidence and confirm how those controls apply to your deployment.
Independent application security assessment
CASA AL1 verified
Cloud Application Security Assessment performed by TAC Security, an independent App Defense Alliance-authorized lab.
- Assessment level
- AL1 · Lab Tested – Lab Verified
- Certification ID
- 09e7f885
- Issued
- August 1, 2026
- Valid through
- August 2, 2027
- Organization
- StorageChain LLC
- Assessed application
- storagechainbyoc498015
What this covers: the validation letter confirms the named application satisfied applicable ADA-CASA AL1 application security requirements. Its control areas include authentication, session management, access control, communications, data validation and configuration. At AL1, the developer provides evidence and compliance statements; the authorized lab reviews evidence or tests when applicable. Review the letter for the assessed scope and assurance level.
- Define your data scopeIdentify sources, data categories, indexing scope and permitted external AI destinations.
- Confirm the configurationReview roles, folder restrictions, authentication, index location and retention requirements.
- Request current evidenceAsk for assessment materials, their scope, and supporting details for your questionnaire.
- Record responsibilitiesConfirm customer and StorageChain obligations, deletion requirements and applicable service terms.
Need a security review package?
Send your questionnaire, assessment request or deployment questions. Our team can provide current materials and clarify their scope.
Assessment scope matters. The CASA AL1 validation applies to the named application and the scope described in the letter. Infrastructure-provider certifications have separate scopes. Review current documentation and your service agreement against your organization’s requirements.
08 / Security concerns
Take action if access is in doubt.
If you suspect exposed credentials or unwanted access, restrict access promptly and gather the information needed for review.
- Revoke or rotate provider accessRevoke the affected OAuth grant or rotate provider credentials, then update the connector.
- Restrict workspace accessReview members and connection permissions. Revoke affected API keys and connector grants where available.
- Review the available recordsCheck provider logs and membership records. Note the affected connection, time window and observed behavior.
- Contact StorageChainEmail info@storagechain.io for review and recovery guidance. Do not include passwords, access tokens or private keys.
09 / Common questions
Answers for your review.
6 questions
Can StorageChain read my cloud credentials?
Stored credential fields are encrypted and omitted from normal connection responses. The backend decrypts them when needed for authorized provider operations. Encryption protects stored secrets; access controls govern who can use connected resources.
Does keeping files in my cloud mean no content is processed elsewhere?
No. Original files remain in source repositories, but indexing and search process selected content and retain derived text, metadata and embeddings. External AI connectors can receive authorized results and document content. Customer-hosted search changes the index location, not necessarily all processing or service data.
Are source permission changes reflected immediately?
StorageChain checks current application membership and configured access when serving protected resources, with additional authorization checks for MCP results. Provider-side changes can also depend on connector synchronization and provider checks. Review permissions and refresh connections when access changes; do not assume every source update is synchronized instantly.
What if I lose my authenticator? Does 2FA protect API keys?
Use one of the single-use backup codes issued during enrollment and keep remaining codes safe. Two-factor authentication protects password sign-in. API keys and connector tokens authenticate separately, so review their permissions, expiration and revocation independently.
How can I withdraw access or leave the service?
Remove member or connection access, revoke unused API keys, and revoke provider credentials or OAuth grants at the source. Source revocation stops future use of that grant; it does not erase an existing search index or content already shared with AI tools. Account deletion is available in Settings. Contact StorageChain to clarify removal and retention requirements for your deployment.
Which certifications or assessments can my team review?
StorageChain LLC completed a CASA AL1 application security assessment with TAC Security for the application storagechainbyoc498015. The validation letter lists certification ID 09e7f885, issued August 1, 2026 and valid through August 2, 2027. View the TAC Security validation letter (opens in new tab) and review its scope. Contact StorageChain for additional materials and deployment-specific controls. Infrastructure-provider certifications have separate scopes.
No matching questions. Try “permissions,” “credentials,” “2FA” or “AI,” or contact our team.
Still have a question?
Contact our team
Get help with your configuration or security review.