Your documents stay yours.
How we protect your project record, who can reach it, and where it lives.
Customer-authorized access
- Your documents, at your requestStoria reads the project documents you authorize. Provider and region are set at onboarding and changed only at your request.
- No training on your dataYour documents never train foundation models, ours or the provider's.
- Enterprise AI termsInference runs under zero-retention, enterprise agreements with AI providers.
Where your data lives
- Canada regionCentral Canada. Default for Canadian public-sector and infrastructure work with data-sovereignty terms.
- U.S. regionsEast / West. For U.S.-based programs that require data to remain within the country.
- Cloud-agnostic hostingDeploys on AWS or Oracle Cloud (OCI), inheriting each provider's physical, network, and datacenter security.
- Network isolationPrivate networking and no direct public access to data stores.
Access controls
- SSO / SAMLSingle sign-on via your identity provider, so access follows your directory.
- Role-based accessGranular roles scoped per record, mapped to project responsibilities.
- Multi-factor authMFA required for all internal and administrative access.
- EncryptionAES-256 at rest. TLS 1.2+ (1.3 preferred) on every connection in transit.
Your tools stay yours
- Data ownership and exportYour data stays yours: full export on request, deletion on termination.
- Policies and incident responseDocumented policies for access, data handling, and incident response, with a defined plan and owners.
Get the documents your team needs.
Security overview, Data Processing Addendum and a security questionnaire, for your procurement review.