Security and privacy by design.

Because the security of your data must be intrinsic.

When it comes to the security and privacy of your data, we believe protection must be intrinsic; inherently present in every component and built for that purpose. Storro’s components are designed to be non-critical and highly resilient, with security that exceeds encryption only.

We do this through encryption, compartmentalization and decentralization amongst other techniques. It goes without saying that the encryption used is of the highest standard. This way you can rest assured your data only comes into the hands of those for whom it is intended.

When it comes to the security and privacy of your data, we believe protection must be intrinsic; inherently present in every component and built for that purpose. Storro’s components are designed to be non-critical and highly resilient, with security that exceeds encryption only.

We do this through encryption, compartmentalization and decentralization amongst other techniques. It goes without saying that the encryption used is of the highest standard. This way you can rest assured your data only comes into the hands of those for whom it is intended.

Encryption

The digital security of your files is our highest priority. That is why Storro uses the highest standards of encryption protocols.

Our encryption is used on three levels:

  • secured end-to-end connections between devices
  • enciphering files on your mounted Storro-drive
  • cryptographically enforcing rights management.

The fundamental cryptographic algorithms used by Storro are:

  • Keccak-f₁₆₀₀ for all symmetric encryption (incl. SHA3)
  • Curve25519 for all asymmetric encryption

The algorithms have no known weaknesses. They have relatively simple specifications without unexplained constants. The algorithms all run in constant time and have fixed memory access patterns. This makes them immune to e.g. side-channel attacks, a vulnerability for regular AES implementations.

Decentralized key management

A key question in cryptography is: where are the keys and who has access to them?

With Storro all keys are generated locally, stored only locally, and solely in possession of the file owner(s). No one else has the keys – in any form – not even the Storro company. There is no central key storage system in Storro, nullifying related vulnerabilities.

Storro’s decentralized approach to key management is unique and in sharp contrast to many of the currently available cloud applications and cloud services offered for (online) collaboration. In those cases, encryption keys are in the hands of the file owner(s), as well as an external party: the cloud provider. As a result this third party is able to go through your “encrypted” data.

Furthermore the keys at third party providers are stored centralized on their premises making it a very interesting target for hackers and malicious actors: a single hack could give a hacker access to countless documents and files.

For a further in-depth example of how Storro’s decentralized key management is used in the application, please read this article on ‘Flexible Decentralized Access using Invitation-Response Dialogue’ by our CTO.

Distributed data storage

All data stored in Storro is ‘cut’ into small – encrypted – data chunks, which are stored spread out over multiple locations.

Compartmentalized data and distributed storage greatly increase resilience and availability, compared to storing all data at one place/provider. Furthermore, this means Storro does not rely on encryption alone; even if a location were to be compromised or the encryption algorithm here broken, no readable information is obtained – only a few encrypted shreds of a file or database.

The result is that out of all the alternatives in the market only Storro can guarantee full security and privacy, ensuring the user’s files only come into the hands of those for whom they are intended.

On top, storage locations can be set up in such a way that your data remains available even if one or a few of the cloud providers fail. By creating this RAID-like system across multiple cloud providers, you can continue to work in the event that a cloud service is (temporarily) unavailable.

Blockchain

Storro features proprietary private blockchain technology: every change to a project (e.g. a modification in a file, inviting a new member, creating a new subfolder, etc.) is recorded in a blockchain based Audit Trail. This trail of project activity is open and transparent to every member of this project and cannot be manipulated, as its information is stored distributed across all project members.

On top, thanks to Storro’s built-in Revision Control feature, one can easily return to every previous state of every file of entire project based on this crypto chain.

Each Storro project encompasses its own private blockchain. The private aspect here pertains to the people across whom the data (the ledger) is distributed, and thus have access to the information; in this case only the members of a specific Storro project. Outside of this group, no other party has insight in the project and its contents – including the Storro company.

Storro’s crypto based Audit Trail and Revision Control is not just very convenient in case of unintentional accidents, but also prevents abuse.

Please read our CTO’s article on ‘Design Requirements for a Branched Blockchain Merging Algorithm’ for more information on the blockchain technology used in Storro.

Security by design makes Storro unique.

Why is Storro the most secure data share and storage solution?

   Storro Alternative solutions Why is Storro better?
EncryptionOn data at rest (on device) as well as on communicationOn communication (data transfer) onlyData on device and/or storage location is always encrypted
Encryption-keyIn possession of data-owner onlyIn possession of data-owner and cloud service providerTrue privacy; third parties do not need to be trusted and cannot go through your data
User-rights managementUser rights cryptographically enforced (by distribution of crypto-key)User rights enforced by software logic (assignment of roles and rights by admin)Hackers can 'escalate' their rights to admin-level within 48h when using software logic. Not so when rights are cryptographically enforced.
Audit trail and activity-loggingUse of blockchain technology to enforce a cryptographically signed audit trail and logUser activity captured in (separate) log-filesLog-files cannot be tempered with (not in real time, nor in hindsight)
Data storage locationAll data is compartmentalized and stored decentralized at multiple locationsAll data at a single cloud-providorWith Storro not 'all golden eggs are in one basket', making it for hacker much more costly to acquire the data
Communication infrastructureDirect (peer-to-peer) communication between collaborating user devicesAll communication goes via central server(s)No single-point-of failure, DDoS protection, faster download, scalable, continue working when internet is down

Start working securely today.

ISO 27001

Data is stored distributed over ISO27001 certified datacentres in the Netherlands.

Storro is a member of the Hague Security Delta.

Storro has received the H2020 seal of excellence by the European Commission.

ISO 27001

3rd parties get neither complete nor readable data, guaranteeing the privacy.