Trust

Security

Effective 27 August 2026

We run the public API and this download site on a dedicated host. The database is not exposed to the public internet. Admin tools live on a separate hostname. Application secrets are loaded by the process manager, not by the public site.

Installers listed here include a SHA-256 checksum when published. Compare it before you run a file if your organisation requires that control.

If you believe you found a vulnerability, email security@storaqapp.com with enough detail to reproduce it. Do not include customer data. We will acknowledge good-faith reports. Do not use this address for account support.