🔐 Data Protection & Security
Technical Security Specifications
Encryption Standards
TLS 1.3 (In Transit)
All data transmitted between your device and our servers is encrypted using TLS 1.3, the latest and most secure encryption standard. This prevents interception and man-in-the-middle attacks.
ECDHE + ChaCha20-Poly1305
AES-256 (At Rest)
All data stored in our databases is encrypted using AES-256 encryption. Even if our database files are stolen, the data inside is mathematically unreadable without the encryption key.
AES-256-GCM encryption with authenticated encryption
bcrypt Password Hashing (12-Round)
User passwords are hashed using bcrypt with 12 rounds of key expansion. This makes brute force password attacks computationally infeasible (would take centuries on modern hardware).
bcrypt with cost factor of 12
Infrastructure Security
Google Cloud Platform
Hosted on GCP with automatic scaling, DDoS protection, and enterprise-grade security.
Geo-Redundancy
Data replicated across multiple geographic regions for high availability and disaster recovery.
ISO 27001 Certified
Our infrastructure meets international information security standards.
SOC 2 Compliant
Annual SOC 2 Type II audits verify our security controls.
Automated Backups
RPO: 1 hour | RTO: 4 hours (Recovery Point Objective and Recovery Time Objective)
24/7 Monitoring
Continuous security monitoring and threat detection.
Defensive Security Layers
Multi-Layer Defense
- Web Application Firewall (WAF) - blocks malicious HTTP requests
- DDoS Protection - defends against volumetric attacks
- Rate Limiting - prevents brute force and abuse
- CSRF Protection - prevents cross-site request forgery
- XSS Prevention - sanitizes all user inputs
- SQL Injection Prevention - parameterized queries used exclusively
Security Testing & Audits
Regular Security Testing
- Quarterly penetration testing by external security firms
- Weekly automated vulnerability scanning
- Responsible disclosure program (security@xarklo.com)
- Bug bounty program for ethical hackers
Company Ownership & Retention Oversight
XARKLO security governance
StoriZad is operated by XARKLO. Security posture, incident review, and retention governance are handled at company level while product-level protections are implemented in StoriZad interfaces and backend systems.
Compliance Frameworks
We Comply With:
- COPPA (Children's Online Privacy Protection Act)
- GDPR (General Data Protection Regulation)
- CCPA (California Consumer Privacy Act)
- UK Children's Code
Report a Security Vulnerability
If you discover a security vulnerability, please contact us responsibly:
Email: security@xarklo.com
Response time: Same day (24/7 monitoring)
Do not publicly disclose the vulnerability until we have fixed it.
🔐 حماية البيانات والأمان
مواصفات أمان تقنية
معايير التشفير
TLS 1.3 (أثناء النقل)
جميع البيانات المرسلة بين جهازك وخوادمنا مشفرة باستخدام TLS 1.3.
AES-256 (في الراحة)
جميع البيانات المخزنة في قواعد بياناتنا مشفرة باستخدام تشفير AES-256.
bcrypt كلمة مرور التجزئة (12-Round)
كلمات المرور مجزأة باستخدام bcrypt مع 12 جولة.
أمان البنية الأساسية
Google Cloud Platform
مستضاف على GCP مع التوسع التلقائي والحماية من DDoS.
التكرار الجغرافي
البيانات المكررة عبر مناطق جغرافية متعددة.
معتمد ISO 27001
البنية الأساسية تفي بمعايير أمان المعلومات الدولية.
SOC 2 متوافق
تدقيق SOC 2 النوع الثاني السنوي.
النسخ الاحتياطية الآلية
RPO: ساعة واحدة | RTO: 4 ساعات
المراقبة 24/7
المراقبة الأمنية المستمرة والكشف عن التهديدات.
الإبلاغ عن ثغرة أمنية
البريد الإلكتروني: security@xarklo.com
وقت الاستجابة: نفس اليوم (مراقبة 24/7)