Enterprise security
Storycards gives enterprise teams one governed environment for creating, publishing and operating interactive products. Control who can work in the platform, how products are protected and where collected data goes.
Security in Storycards starts with clear boundaries. Your organization defines who can create, edit, publish and access data. Storycards protects the platform and published products with infrastructure, application and monitoring controls.
This model gives business teams room to create while security, IT and data teams retain the controls needed to operate within organizational policy.
Security model
Each layer answers a different part of the security review, from account access to the destination of collected first-party data.
Use single sign-on, two-step verification and organization-level password policies to protect account access.
Limit access by organization, team and product so each person can work only with the tools and data they need.
Choose whether collected data is stored in Storycards or transferred directly to systems your organization controls.
Protect published products and platform traffic with encrypted connections, edge controls and continuous monitoring.
Data ownership and routing
Storycards supports two operating models. Choose the path that fits the sensitivity of the use case and the systems your organization already governs.
Direct transfer
Use Data Bridge to send collected data directly to your server or database without storing that collected data in the Storycards cloud. Your systems apply the storage, retention and downstream processing rules.
Storycards cloud
Keep collected data in Storycards for platform workflows and analytics. Your organization retains control and can delete the data when it is no longer needed.
People engage with a published or embedded Storycards product.
The product captures the answers and interaction events you configure.
Data moves to Storycards or directly into your server, database, CRM or data stack.
Platform protection
Layered controls protect the workspace where teams build and the interactive products delivered to your audience.
Publish interactive products without creating and maintaining a separate hosting environment.
Storycards uses HTTPS with TLS 1.2+ for data in transit and AES-256 encryption for data stored in the platform.
Cloudflare and AWS Web Application Firewall (AWS WAF) apply layered filtering across the product, while DDoS protection helps absorb disruptive traffic.
Platform activity and infrastructure are monitored 24/7 to surface potential threats and support rapid investigation and mitigation.
Apply SSO-only or hybrid access, two-step verification and password requirements that fit the way your organization manages identity.
Define who can create, edit, publish or work with collected data across teams and products.
Technical assurance
Security controls extend from the cloud environment and application edge to stored data, recovery and ongoing monitoring.
Storycards runs its managed platform on AWS, with Cloudflare protecting and accelerating traffic at the application edge.
Cloudflare and AWS Web Application Firewall (AWS WAF) protect multiple layers of the product. Machine-learning-assisted traffic analysis and managed filtering help identify malicious or automated activity while legitimate requests continue.
DDoS protection helps absorb and filter disruptive traffic while managed infrastructure supports continued delivery of published products.
Monitoring runs 24/7 across platform activity and infrastructure so the team can detect, investigate and mitigate potential threats quickly.
Use SSO with Google Workspace, Microsoft Entra ID, Okta, OneLogin, Auth0, JumpCloud or another OIDC-compatible provider. Organizations can require SSO-only access or keep password access for approved external collaborators.
Dedicated organization login pages, records of successful and failed login attempts, automated IP lockouts, password-expiration policies and data-download logs give administrators visibility into sensitive activity.
Uploaded files are held in a private, isolated environment and automatically scanned for viruses and malware before they become available. Access is limited by organization permissions, and authorized users can delete files from the platform.
The data path follows the operating model you choose. Collected data can remain in Storycards or move directly to infrastructure your organization controls through Data Bridge.
Storycards can record the UTC timestamp, IP address and state of configured consent fields for each submission. Administrators can review, export and delete collected records through controlled platform workflows.
Backups and recovery procedures protect platform data stored by Storycards. Retention and recovery requirements can be reviewed for the selected enterprise use case.
HTTPS with TLS 1.2+ protects data in transit, while AES-256 protects data stored in the platform.
Independent assurance
Technical controls are supported by independent testing, documented data-processing terms and a structured path for customer due diligence.
External validation
Independent cybersecurity firms perform penetration testing every six months. Findings are reviewed, prioritized and tracked through remediation.
Compliance program
Storycards is preparing for a SOC 2 examination and is implementing controls aligned with the AICPA Trust Services Criteria.
Privacy and governance
Storycards applies a Privacy by Design approach. Our data-processing terms address processing roles, subprocessors, international transfers, deletion and cooperation in the event of a data incident.
Due diligence
Review architecture, deployment, data flow and relevant security controls with our enterprise team. Sensitive materials can be handled through the appropriate review process.
SOC 2 is an independent examination of controls. The Storycards examination is not yet complete, and no SOC 2 report or certification is claimed on this page.
Security review
Security requirements vary by organization and use case. Our enterprise team can walk your technical stakeholders through the relevant controls and data flow before rollout.
Talk to our enterprise teamReview how Storycards products are hosted, published or embedded in your existing digital environment.
Map what is collected, where it is sent, whether it is stored and which system remains the source of truth.
Align SSO, two-step verification, password requirements, roles and permissions with your internal policies.
Walk through encryption, certificates, traffic filtering, DDoS protection and monitoring controls.
Common security questions
Yes. Data Bridge can transfer collected data directly to your server or database without storing that collected data in the Storycards cloud.
Yes. When you choose Storycards cloud storage, your organization controls the data and can delete it when it is no longer needed.
Organizations can use SSO, two-step verification by email, SMS or an authenticator app, configurable password requirements and role-based permissions across products, features and data. Authenticator options include your organization’s solution, Google Authenticator and Microsoft Authenticator.
Published products use SSL certificates and HTTPS with TLS 1.2+. Cloudflare and AWS WAF apply layered traffic filtering, including machine-learning-assisted protections, alongside DDoS protection and 24/7 monitoring.
Storycards supports Google Workspace, Microsoft Entra ID, Okta, OneLogin, Auth0, JumpCloud and other OpenID Connect-compatible identity providers. Organizations can enforce SSO-only access or use a hybrid model for approved external collaborators.
Files are uploaded into a private, isolated environment and scanned automatically for viruses and malware before they become available. Only authorized organization users can access them, and files can be deleted through the platform.
No. Storycards AI assembles production-tested Storycards components configured to your design system and brand rules. AI-created products remain inside the same permission, review and publishing controls as products created manually.
Share your use case, data flow and access requirements with our enterprise team.
