Security at Stormzo

Your chapter trusts us with its members’ names, careers and contact details. Here is how we keep that private.

Last updated October 6, 2026

Every chapter is walled off

Each chapter’s data is tagged to that chapter, and the database itself enforces who can see it, on every request.

Even a bug in the app can’t return another chapter’s members, because the database refuses the request.

We never see card numbers

All payments go through Stripe, which is certified PCI DSS Level 1, the highest level for handling payments.

Card and bank details go straight to Stripe and never touch Stormzo’s servers.

Secure sign-in

Sign-in runs on Supabase Auth, an established login service. Passwords are stored as one-way hashes, never as readable text.

Members join only through their chapter’s private invite link, and admin powers are limited to admins of that chapter.

Encrypted everywhere

All traffic to Stormzo is encrypted with HTTPS (TLS). Data stored in the database is encrypted at rest (AES-256).

Private files

Résumés, photos and message attachments are stored under long, unguessable links. They can’t be browsed, listed or searched for.

Uploads are limited by file type and size.

Responsible email

Invites come from Stormzo’s verified sending domain. Addresses that bounce or report spam are automatically never emailed again.

Built on audited infrastructure

We don’t run our own servers. Stormzo runs on providers that are independently audited every year.

Supabase

Database, sign-in and file storage

SOC 2 Type II

Vercel

Hosting

SOC 2 Type II

Stripe

Payments and donations

SOC 2 Type II · PCI DSS Level 1

How we work

  • We review Stormzo’s code and database rules for security issues and fix what we find quickly. Our latest full review had every high and medium finding fixed within a day.
  • Access to production systems is limited to the founder, with two-factor authentication on the hosting account.
  • Fixes ship continuously. There’s nothing for chapters to install or update.

Your data stays yours

We don’t sell member data or show ads. Any member can ask us to correct or delete their information. See our Privacy Policy for the details.

Found a security issue?

Please tell us. Email info@stormzo.org with “Security” in the subject line, and we’ll get back to you quickly. Have a question from your chapter, national HQ or university? Use the same address.