Last updated: November 8, 2026
GDPR Compliance
Stored is committed to compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"). This page describes how our service maps to GDPR requirements. For the full legal framework, see our Privacy Policy and Data Processing Agreement.
Contents
- Article 5, Data Processing Principles
- Article 17, Right to Erasure
- Article 20, Data Portability
- Article 25, Data Protection by Design
- Article 28, Data Processing
- Article 32, Security of Processing
- Articles 33/34, Breach Notification
- Data Residency
- Sub-processors
- Contact
Article 5, Data Processing Principles
Stored adheres to the core GDPR principles in the design and operation of our service:
- Data minimization: We store only the objects you upload and the minimal account metadata required to operate the service (email, hashed password, billing information). We do not collect analytics, behavioral data, or advertising profiles.
- Purpose limitation: Your data is processed solely for the purpose of providing object storage and delivery. We do not access, analyze, or profile the content of stored objects.
- Storage limitation: Account data is retained only for the duration of your account. Upon account deletion, a 30-day grace period allows data recovery, after which the account is closed and our deletion job erases your objects, keys and account records on the scheduled date; backups age out within 30 days. Large objects are stored in deduplicated blocks: the blocks of your objects are released on that date and deleted by the storage collector once its seven-day safety period has passed, except a block that is byte-for-byte identical to one another customer stores, which remains as that customer's data.
Article 17, Right to Erasure
Data subjects have the right to request deletion of their personal data. Stored supports this through:
- Account deletion: Available via the dashboard settings page or the management API (
DELETE /account). Initiates a 30-day grace period, after which the account is closed, the subscription is cancelled and our deletion job erases your objects, keys and account records on the scheduled date. Large objects are stored in deduplicated blocks: the blocks of your objects are released on that date and deleted by the storage collector once its seven-day safety period has passed, except a block that is byte-for-byte identical to one another customer stores, which remains as that customer's data. - Object deletion: Individual objects can be deleted at any time via the S3-compatible API (
DELETEoperation) or dashboard. - Cancellation: Account deletion can be cancelled during the 30-day grace period via the dashboard settings page.
Object Lock exemption: Objects protected by Object Lock (WORM retention) cannot be deleted until the retention period expires. This is a legal compliance mechanism, if you use Object Lock for regulatory retention, erasure requests are deferred until the retention period concludes.
Article 20, Data Portability
Stored provides full data portability through multiple channels:
- S3-compatible API: All stored objects are accessible via the standard S3 protocol. You can export your entire data set using any S3-compatible tool,
aws-cli,boto3,rclone,s3cmd, Cyberduck, and others, with zero modification. - GDPR data export: The dashboard settings page (and
POST /api/v1/manage/account/export) requests a data export; it is prepared within minutes as one JSON file in a private system bucket of your account, downloadable for 7 days through a link only you can see. It contains all account data: profile, tenant information, quotas, buckets, objects, versions, locks, API keys, and 90 days of bandwidth history. - No proprietary formats: Objects are returned byte-for-byte through the S3 API. At rest, large objects may be split into chunks and compressed by our engine; no proprietary client or format is ever needed to read your data back.
Article 25, Data Protection by Design
Privacy and security are built into Stored from the ground up:
- Encryption: all connections are encrypted in transit (TLS 1.2 or higher; HSTS is enforced at our edge). At rest you can encrypt with your own keys (SSE-C, the key travels with each request and is never stored) or client-side; server-managed encryption at rest (SSE-S3, AES-256-GCM with ML-KEM-768 key encapsulation) is implemented and tested but not yet enabled in production. Objects held by our storage sub-processors are additionally subject to those providers' own at-rest encryption.
- Scoped API keys: API keys can be scoped to specific buckets and operations, following the principle of least privilege.
- Two-factor authentication: TOTP-based 2FA is available for all accounts and enforced for administrative access.
- No tracking: Stored does not use analytics cookies, advertising trackers, or third-party behavioral tracking scripts.
Article 28, Data Processing
When you use Stored, FairForge LLC acts as a Data Processor on your behalf. Our processing obligations are formalized in our Data Processing Agreement, which covers:
- Processing only on documented instructions from the Controller.
- Confidentiality obligations for all authorized personnel.
- Technical and organizational security measures.
- Assistance with data subject requests and data protection impact assessments.
- Audit rights for the Controller.
To execute a DPA for your organization, visit our DPA page or contact privacy@stored.cloud.
Article 32, Security of Processing
Stored implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk:
- Encryption: TLS 1.2+ in transit (HSTS at the edge); SSE-C or client-side encryption at rest on request, server-managed SSE-S3 (AES-256-GCM, ML-KEM-768) is implemented but not yet enabled in production.
- Access controls: Per-tenant credentials, scoped API keys, role-based dashboard access.
- Integrity: ETag (MD5) verification on every upload, Object Lock (WORM) for immutable retention, MFA Delete for versioned objects.
- Audit logging: API operations, account access, and administrative actions are logged.
- Breach notification: Automated breach tracking with 72-hour notification deadline, severity assessment, and affected user notification (see below).
- Backups: Database backups: a daily copy kept 7 days on the production host and 30 days off it, encrypted, and a continuous encrypted archive for point-in-time recovery reaching back 28 days.
Articles 33/34, Breach Notification
Stored maintains a breach response workflow compliant with GDPR Articles 33 and 34:
- 72-hour notification: In the event of a personal data breach, we will notify affected Controllers without undue delay, and in no case later than 72 hours after becoming aware of the breach.
- Severity assessment: Each incident is assessed for severity and scope to determine notification obligations to supervisory authorities and affected individuals.
- Notification content: Breach notifications include the nature of the breach, categories and approximate number of affected data subjects, likely consequences, and measures taken or proposed to address the breach.
- Data subject notification: When a breach is likely to result in a high risk to the rights and freedoms of individuals, affected data subjects are notified directly.
For HIPAA-covered entities, our Business Associate Agreement provides additional breach notification commitments.
Data Residency
Default storage is in the United States: a bucket in the default region (us-central-1) is stored in Virginia with our infrastructure partner Seagate Technology. Additional regions are operated by our partner iDrive e2, enabled per deployment and offered in the bucket-creation region picker; regions that are not enabled cannot be selected. The regions are:
| Region | Location |
|---|---|
| us-central-1 | United States (default), stored in Virginia |
| us-west-2 | Los Angeles, United States |
| us-west-4 | Oregon, United States |
| us-southwest-1 | Phoenix, United States |
| us-southeast-1 | Miami, United States |
| us-midwest-1 | Chicago, United States |
| us-east-1 | Virginia, United States |
| eu-west-1 | Ireland |
| eu-west-3 | London, United Kingdom |
| eu-west-4 | Paris, France |
| eu-central-1 | Frankfurt, Germany |
| eu-south-1 | Milan, Italy |
| ap-northeast-1 | Tokyo, Japan |
| ap-southeast-2 | Singapore |
A bucket's region is fixed at creation and its Standard-tier objects are stored only in that region: EU regions keep data within the European Union and United Kingdom as labelled above. Two exceptions apply whatever the bucket's region: objects stored in the Vault tier (storage class GLACIER / DEEP_ARCHIVE, or a Vault bucket) are written to our tape partner in Los Angeles, United States, and their parity copy is kept in the United States; and the objects of public-read buckets are served from Cloudflare R2. International data transfers are governed by Standard Contractual Clauses as described in our DPA.
Sub-processors
Stored engages the following sub-processors in delivering the service:
| Sub-processor | Purpose | Location |
|---|---|---|
| iDrive Inc. | Object storage, Standard tier, for a bucket in a region other than the default; a second copy of default-region objects, in the United States, when one is kept | United States / EU / United Kingdom / Japan / Singapore (the bucket's region) |
| Seagate Technology (Lyve Cloud) | Object storage, Standard tier in the default region, resilient tier, failover; the parity second copy of Vault-tier objects | United States |
| Geyser Data Inc. | Tape archive, Vault tier (all regions) | United States (Los Angeles) |
| Cloudflare Inc. | CDN, DDoS protection, TLS; the bytes of uploads to the S3 endpoint s3.stored.cloud in transit through its edge; R2 storage for public-read buckets and the encrypted point-in-time archive of the database | Global (edge network) / United States |
| Microsoft Corporation | Cloud storage infrastructure: internal parity copies, when enabled | United States |
| Sync.com Inc. | The encrypted off-site copy of the database backups; a standby location for the parity copies of Vault-tier objects | Canada |
| Blomp | A second encrypted off-site copy of the database backups | United States |
| Stripe Inc. | Payment processing | United States |
| Resend Inc. | Transactional e-mail, when enabled | United States |
| Google LLC / GitHub Inc. | OAuth sign-in (only if used) | United States |
Changes to sub-processors are communicated with at least 30 days' notice. The full sub-processor list and notification process are documented in our DPA.
Contact
For GDPR-related inquiries, data subject requests, or to exercise your rights:
- Data Protection Officer: dpo@stored.cloud
- Compliance: compliance@stored.cloud
- Entity: FairForge LLC, Salt Lake City, Utah, United States