OneStore Security

Version française →

OneStore handles your Apple .p8 keys and Google service account .json files — the credentials that can publish to your stores. OneStore security is designed around one rule: those secrets are decrypted only when you trigger an action, and only long enough to complete it.

In practice: store credentials are encrypted at rest with AES-256-GCM at the application layer, 100% of browser and API traffic is served over HTTPS (TLS 1.2 and above), and production runs on Vercel and Neon with workspace-scoped isolation. Access inside a workspace follows least-privilege roles — OWNER, ADMIN, and MEMBER — with a full audit log of sensitive actions. We publish live service status at status.onestore.so.

Encryption

Sensitive data — especially Apple and Google store credentials — is encrypted before it reaches the database.

• At rest: AES-256-GCM at the application layer. Each ciphertext includes an authentication tag so tampering is detected on decrypt.
• Key management: The master encryption key lives in a server-side secret store. It is never sent to the browser, never logged, and never included in API responses.
• In transit: HTTPS everywhere — the marketing site, the signed-in app, and all API routes. Connections use modern TLS (1.2+); Vercel terminates TLS at the edge.
• Apple API tokens: When OneStore talks to App Store Connect, we derive short-lived ES256 JWTs per request instead of reusing long-lived bearer tokens.
• Uploaded binaries: .ipa and .aab files are stored temporarily in Cloudflare R2 for delivery, then removed after processing — typically within a few days.

Access

OneStore is a multi-tenant product. Every workspace is isolated at the data layer; members only see apps and credentials belonging to their workspace.

• Authentication: Sign-in via OAuth (Google or GitHub). We do not store passwords. You can revoke any active session from Account → Sessions, or sign out all other devices in one action.
• Role-based access: Three workspace roles — OWNER, ADMIN, MEMBER. Connecting store credentials, publishing metadata, uploading binaries, and deleting apps require ADMIN or OWNER. Read-only members can view listings without write access.
• Least privilege in code: API routes enforce role checks server-side before any store credential is decrypted. Sensitive operations cannot be triggered from a MEMBER session even if the UI is manipulated.
• Audit log: Access to credentials, listing edits, publishes, and app deletions are recorded per workspace with actor, timestamp, and action type — visible to workspace admins.
• Internal access: Production database access is limited to operators who need it for incidents. We do not browse customer listing content as part of normal operations.

Hosting

OneStore production runs on managed cloud infrastructure. Sub-processor locations and purposes are listed in our Data Processing Agreement.

• Vercel — Next.js application hosting, edge network, TLS termination (US / EU regions).
• Neon — PostgreSQL database for accounts, workspaces, encrypted credentials, and audit events (EU / US by project region).
• Cloudflare R2 — Screenshot assets and temporary binary storage (global edge).
• Upstash — Background job queues and scheduled sync workers (US / EU).

We monitor OneStore and upstream Apple/Google API availability on our status page, with observed uptime over 24h, 7d, 30d, and 90d windows. Enterprise customers on the Scale plan can negotiate a dedicated SLA; self-serve plans follow our standard terms.

Targeted compliance

OneStore is built by Karei Studio. We process personal and store data under the GDPR and provide a DPA based on EU Standard Contractual Clauses on request.

• GDPR: Privacy policy at onestore.so/privacy. Data export and deletion requests handled via support@onestore.so. Breach notification within 72 hours per our DPA.
• SOC 2 Type II: Audit planned for Q4 2026. Controls cover access management, encryption, logging, and vendor review.
• ISO 27001: Target certification in 2027, aligned with the same control framework as our SOC 2 roadmap.

Until formal certifications are complete, we document technical and organizational measures in the DPA and keep this page updated as controls ship.

Responsible disclosure

Found a vulnerability in OneStore? We want to hear from you before you share it publicly.

• Contact: security@onestore.so. PGP key available on request.
• Response time: We acknowledge reports within 48 business hours and provide a severity assessment within 5 business days.
• Scope: onestore.so, the OneStore web application, and our API endpoints. Out of scope: third-party store APIs (Apple, Google), social engineering, and denial-of-service tests without prior agreement.
• Bug bounty: Not active yet — we will publish terms here when it launches.

To report a vulnerability, email security@onestore.so. We acknowledge reports within 48 business hours.

For general security questions (not vulnerability reports), support@onestore.so works too. See also our privacy policy and DPA.

Questions about our security practices? Contact our team or learn more about OneStore — published by Karei Studio. Follow us on X and LinkedIn.