Documentation Security and your data
Encryption
Connections to the app and the API use HTTPS with TLS 1.2 or later. The MySQL database and the file storage that hold your workspace are encrypted at rest.
This page lists what Sterodata's configuration sets for encryption, and nothing it does not.
In transit
- The app, at
app.sterodata.com, is served over HTTPS only: a plain HTTP address is redirected to HTTPS. Connections need TLS 1.2 or later. - The API, at
api.sterodata.com, which the app and connected assistants use, accepts HTTPS with TLS 1.2 or later. - Files are uploaded and opened through signed addresses that expire. An address to open an attached file stops working after at most 24 hours; an address to upload a file to import, after an hour.
At rest
| What | How it is protected |
|---|---|
| Workspace details (MySQL on Amazon RDS) | Storage encrypted. |
| Your records (the database files on Amazon EFS) | File system encrypted. |
| Passwords for connected databases and keys for connected services | Kept as encrypted parameters in AWS Systems Manager Parameter Store, not in the database. |
| Your account password | Held by Amazon Cognito. Sterodata does not store it. |
| Connected assistants' tokens | Only a SHA-256 hash of each token is stored, so the stored value cannot be used to connect (see Connected assistants' access). |
Signing in
Passwords need at least 8 characters, with a capital letter, a small letter and a number. A signed-in request to the API carries a signed token from Amazon Cognito, checked before anything is read, and what the person may reach is then checked against the workspace's own rules (see Access).
Sign-in is by email and password only. There is no single sign-on and no second sign-in step.
Last updated 29 October 2026