Security
Storm is an engineer with credentials to systems that move money, so the questions worth answering are what it can touch, what stops it acting alone, and what Storm has not earned yet. All three are on this page rather than left to be discovered.
What Storm can touch
Three surfaces, each granted separately. Nothing outside them, and nothing inside them that you have not granted.
| Surface | Why it needs it | Shape of the access |
|---|---|---|
| Your repository | The meter lives in code. Changing it means changing code. | Read. Every write arrives as a pull request your team reviews and merges. |
| Your billing account | Products, prices, plan migrations, and the invoices to reconcile against. | A scoped credential you issue and can revoke from Slack. |
| Your warehouse | Replaying a proposed change against real history before it ships. | Read, on the usage tables you name. No write path. |
How the access is constrained
Nothing ships without a person
This is the control everything else rests on. Storm proposes; a human approves in the thread; only then does anything reach production. A model never assigns a price, a tier, or a usage class at runtime — it writes the rule that does, and you read the rule first.
Access is scoped per surface, not granted once
Each surface above is granted separately and can be revoked separately, from Slack, without waiting on anyone. There is no single credential that unlocks the set, and a grant you have not made is not a grant Storm can ask its way into.
Your raw usage stays where it is
Storm reads what a question requires and writes back through the same interfaces your team uses. Getting a meter built does not require shipping a copy of your event stream anywhere, which means there is no second archive of your usage to store, secure, or subpoena.
The audit trail is the conversation
Every action is recorded against the request that asked for it. Reconstructing why a number changed is reading one thread, not correlating a log with a ticket with a deploy — and the pull request is an ordinary one, in your history, under your review rules.
What a Storm compromise would expose
Commercial metadata: customer and operation identifiers, prices, commitment balances, and billing records, plus whatever the credentials you granted reach. That is genuinely sensitive and should be treated as such. Revoking the grants is the containment step, and it does not require Storm’s cooperation.
Compliance status
Stated plainly. Storm is early, and the right response to a security questionnaire is this table plus a conversation about which rows are gating — not a claim of certifications it does not hold.
| Item | Status | Detail |
|---|---|---|
| SOC 2 | Not held | No audit has been performed. |
| ISO 27001 | Not held | No audit has been performed. |
| Third-party penetration test | Not performed | A scoped statement of work and a researched vendor shortlist exist; the engagement is not commissioned. |
| DPA | Not executed | Storm is prepared to sign customer paper. |
| E&O and cyber insurance | In procurement | Not yet bound. Stated because a liability position without insurance behind it is a number, not a commitment. |
| Subprocessor list | Published | Five entries with role, data touched, and region. 30 days’ written notice before adding one. |
| Backup restore drill | Performed 2026-07-28 | A point-in-time branch recovered a finalized record whose content hash matched the live reconciliation export, and asserted zero revoked credentials came back. |
Controls that are enforced rather than promised
In the systems Storm itself runs, these are properties of the database and the configuration rather than of the application code, so they hold whether or not a code path remembers to check.
- Finalized billing records are immutable in the database itself — triggers refuse every update and delete against a closed record, regardless of application code.
- The administrative audit ledger is append-only and carries a per-organization hash chain computed by the database, verified independently so a disagreement between the two is itself the finding.
- Every tenant relationship is a composite foreign key carrying the organization id, so a row cannot reference another organization’s row.
- Transport without TLS, an http:// control plane, an image referenced by tag rather than digest, and a maintenance cron without its secret all fail closed.
The control-by-control detail, including residual risk, is in the security questionnaire response available under NDA.
Reporting a vulnerability
[email protected]. Acknowledged within 2 business days, assessed within 5. Good-faith research is authorised and Storm will not pursue legal action over it. The full policy, including scope and safe harbour, is at /.well-known/security.txt.
There is no bug bounty. Storm is pre-revenue and will not advertise a reward it cannot pay.
Subprocessors
The current list, with role, data touched, and region per entry. Storm commits to 30 days’ written notice before adding one.