Skip to content

Security & architecture

How Stowbook is built.

Stowbook asks you to photograph everything you own. That is a genuinely sensitive thing to hand to a piece of software, and "we take your privacy seriously" is not an answer. This page is the real one: what the system is made of, what we can see, what we cannot, and what we do not claim.

Last updated: 2026-07-25

Where your data lives

When you sign up you choose a region: the United States (AWS US-East-2, Ohio) or the European Union (AWS EU-Central-1, Frankfurt).

These are not one system with a preference flag. They are two completely separate deployments — separate databases, separate storage, separate application instances — and no user data moves between them. The choice is fixed to your account at signup, so your data cannot be quietly relocated later for someone's cost optimisation.

If you are in the EU and want your data to stay in the EU, that is a property of the architecture rather than a promise in a document.

Infrastructure

Stowbook runs on Amazon Web Services. We are saying this plainly because you would find out anyway, and because it is load-bearing for everything else on this page.

What that gets you, concretely:

  • There are no servers to leave unpatched. Stowbook is built on managed, serverless components — application code runs on AWS Lambda and Fargate, data lives in DynamoDB and S3. There is no long-lived virtual machine sitting on the internet accumulating unapplied security updates, because that is the single most common way small operations get breached.
  • Storage and database encryption at rest and TLS for everything in transit, as a platform default rather than something we had to remember to switch on.
  • Narrow, per-component permissions. Each part of the system gets its own identity with access to only the specific data it needs. The component that resizes your photos cannot read your billing records; the component that sends email cannot read your inventory.
  • Regional isolation is enforced by the infrastructure, not by application logic that could have a bug in it.

If you would rather not have your data on AWS at all, that is a legitimate position and Stowbook is not the product for you. We would rather say so here than have you find out later.

Accounts and sessions

  • Passwords are hashed with argon2id, the current recommended password-hashing algorithm, with deliberately expensive parameters. We never store your password, and we cannot recover it.
  • New passwords are screened against known breached-password corpora using a k-anonymity API — only a short fragment of the hash of your password ever leaves your device, and never the password itself. If your chosen password has appeared in a public breach, we tell you.
  • Session tokens are opaque random values, not JWTs. This is a deliberate choice: it means a session can be revoked instantly and centrally, rather than remaining valid until it expires.
  • Mobile sessions rotate, and reuse is detected. If an old session token is ever replayed — the signature of a stolen token — the entire session lineage is revoked rather than just the one token.
  • Web sessions use hardened cookies (__Host- prefixed, HttpOnly, short-lived) with cross-site request forgery protection.
  • Sensitive actions bypass caching. Changing your password or email, deleting your account, and anything touching payment re-check your session against the authoritative record rather than a cached copy.

Your photos and the AI

When you scan an item, the photo is sent to a cloud AI vision service to identify what is in it, and then stored in your account in your chosen region.

  • The AI provider processes the image under a data-processing agreement and does not use your photos to train its models.
  • We may change AI providers over time — the current provider and any replacement are named in the privacy policy, which is updated when it changes. Whichever provider is in use, the same terms apply: processing only, no training, and the region your data is processed in matches the region you chose.
  • Scanning is optional. Stowbook works perfectly well as a manual inventory, and nothing is sent to any AI service unless you scan something.

Retention and deletion

The privacy policy contains a retention table covering every category of data we hold, including the awkward ones. The short version:

  • Your inventory and photos are kept until you delete them, or delete your account.
  • Deleting your account deletes your inventory, your photos, and your personal details. Anonymous financial transaction records are retained because tax law requires it — they contain no name, no email, and no inventory content.
  • You can export everything, free, at any time, with photos, and without an upgrade or a support request. An inventory you cannot get out of the app is not a record.

What we do not do

  • We do not sell your data, and there is nobody to sell it to.
  • We do not serve advertising.
  • We do not use third-party analytics or tracking, on this website or in the app.
  • We do not share your data with anyone not named in the privacy policy.

What we do not claim

Any security page that only lists strengths is marketing. Here are the honest limits, so you can make a real decision:

  • Stowbook is not end-to-end encrypted. Your data is encrypted in transit and at rest, but Stowbook can technically read your inventory — that is what makes AI scanning, server-side search, and web access possible. If you need a system whose operator provably cannot read your data, Stowbook does not meet that bar today, and we would rather tell you than let you assume otherwise.
  • Stowbook has no SOC 2 report or third-party security certification. Those are expensive and we have not bought one. What we offer instead is specificity: this page describes the actual design, and the retention table in the privacy policy states real numbers.
  • Stowbook is operated by one person. That means decisions are fast and there is no diffusion of responsibility, but it also means there is no 24/7 security operations team. Choose accordingly.
  • No system is unbreachable. The relevant questions are how much damage a breach could do and how quickly you would hear about it. We work on the first by holding as little as possible for as short a time as possible, and commit to the second below.

If something goes wrong

If Stowbook suffers a breach affecting your data, we will notify affected users directly by email, and within the timeframes required by applicable law — for EU and UK users, within 72 hours of becoming aware of it, per GDPR.

Reporting a vulnerability

If you have found a security problem in Stowbook, we want to hear about it and you will not get a legal threat for telling us.

  • Email security@stowbook.app. Include enough detail to reproduce the issue.
  • We will acknowledge your report within 5 working days and keep you updated until it is resolved.
  • Please give us reasonable time to fix the issue before disclosing it publicly, and please do not access, modify, or delete data belonging to anyone other than an account you control while testing.
  • Good-faith research conducted within those bounds is welcome. We will credit you if you would like to be credited.

Machine-readable contact details are published at /.well-known/security.txt.

Ongoing review

Stowbook's codebase is subject to repeated automated security review as part of development, with findings tracked and fixed. We do not publish the findings themselves — a public list of a system's past weak points is more useful to an attacker than to you.

Questions about anything on this page: security@stowbook.app. For data-protection questions specifically, see the privacy policy or contact privacy@stowbook.app.