1 The basics
Where is my data stored?
Your workspace data lives in a managed PostgreSQL database and object storage, hosted in the United States by default. Physical data-center security is handled by our certified cloud providers. The full list is in our Subprocessors page.
Is my data encrypted?
Yes. Data is encrypted in transit over TLS and encrypted at rest in our managed database and object storage. Application secrets and third-party API keys are held server-side and are never shipped to the browser.
Can another customer see my data?
No. Every record is scoped to a single workspace and protected by row-level security in Postgres, not just hidden in the interface. Access is default-deny, so one workspace can never read or write another's data, even if a request tries to.
Who at Stelaah can see my data?
Access is limited to what is needed to run and support the service. We do not sell your data, and we do not use your workspace content to train third-party AI models. See our Privacy Policy.
2 Access & accounts
How do people sign in?
You can sign in with an email address and password, or with your Google account. Every action resolves to an identified user, and owners, admins, and members see what their role allows. Per-person grants let you tune access without rebuilding anything.
Do you offer two-factor authentication?
If you sign in with Google, your account is protected by whatever two-factor authentication you have enabled on that Google account. Native two-factor for email and password sign-in is on our roadmap. If your organization requires enforced multi-factor today, tell us at security@stelaah.com.
Do you support SSO or SAML?
Google sign-in is available today. For enterprise SAML or another single sign-on provider, contact security@stelaah.com and we will walk you through current options.
What happens when someone leaves the team?
An owner or admin deactivates the member and reassigns their work. Because access is enforced at the database, removing a member removes their ability to query workspace data, not just their menu items.
Are administrative actions attributed?
Yes. Administrative "act-as" actions are attributed to the real signed-in user, and meaningful changes are recorded in tenant-scoped, append-only audit logs.
3 Your data & privacy
Do you sell my data?
No. We never sell your data or share it for advertising.
Do you use my data to train AI?
No. We do not use your workspace content to train third-party foundation models. The details are in our AI Security & Privacy FAQ and Aria AI Terms.
Can I export everything?
Yes. You own your data and can export everything in a structured, common format at any time.
How do I delete my data?
Deletion is handled through a retention workflow rather than a blind hard delete. Deletions are recoverable for a window before permanent removal, and some records may be retained where required for tax, accounting, contract, security, or legal reasons. Owners and admins control retention policies and legal holds in Settings.
How do you handle GDPR and CCPA?
Our handling of personal data you store is governed by our Data Processing Addendum, under which you are the controller and Stelaah is your processor. Privacy rights requests go to privacy@stelaah.com.
4 Reliability & recovery
Do you back up my data?
Yes. Our infrastructure provider maintains automated backups with point-in-time recovery. Within the product, user data is never hard-deleted by default, so a mistake doesn't mean lost work.
What is your uptime commitment?
Our target and service credits are described in the Service Level Agreement.
Can I get evidence for an audit?
Yes. Owners and admins can export an Audit Pack from Settings with CSV evidence, retention and deletion evidence, a security scorecard, and a printable review summary. Secrets and credential-like fields are redacted from exported payloads.
5 Compliance & reviews
Do you have SOC 2 or ISO 27001?
We would rather show real than impressive. We do not claim a formal SOC 2, ISO 27001, HIPAA, PCI, or FedRAMP certification until one is actually complete, and we will list certifications on our Security overview only when they are real. In the meantime we answer procurement reviews from current implementation evidence.
Can you complete our vendor security questionnaire?
Yes. Send it to security@stelaah.com. We answer from real, current implementation: TLS in transit, managed encrypted storage at rest, US hosting by default, database row-level security for tenant isolation, an owner and admin Audit Pack export, retention and deletion evidence, and documented responsible disclosure.
Where can I read the full security model?
Our Security overview walks through tenant isolation, three-tier access, encryption, backups, audit logging, retention, and more.
6 Reporting a problem
I found a security vulnerability. What do I do?
Please report it to security@stelaah.com rather than exploiting it. We support good-faith research conducted without harming users or data, and we will not pursue action against researchers who follow responsible disclosure.
How do I ask a security or privacy question?
Email security@stelaah.com for security, or privacy@stelaah.com for privacy and data rights.
Related: Security overview, Privacy Policy, and AI Security & Privacy FAQ.
Back to top