Security you can trust.
StoryBox protects highly sensitive information about children in care. Every part of the product is designed with the highest standard of data protection in mind.
Kept safe
Trusted circle
Held with care
Private moments
Everyday joy
Encrypted by default
Data is encrypted in transit and at rest. Media is stored in a private, signed-URL bucket only assigned staff can read.
Strict tenant isolation
Multi-tenant Row-Level Security ensures one organisation can never see another's data — enforced at the database, not just in the app.
Passwordless sign-in
Email OTP only — no passwords to forget, phish or reuse. Sessions time out automatically after inactivity.
Role-based access
Admin, Manager, Staff and Young Person roles — each with a tightly-scoped view. Managers see only their organisation; staff see only assigned StoryBoxes.
Full audit trail
Every sensitive action is logged — uploads, exports, role changes, sign-ins. Auditable by managers and admins.
Secure, EU-hosted infrastructure
Built on enterprise infrastructure with regular penetration tests and aligned to ISO/IEC 27001 practices.
Questions about security?
We're happy to share our security documentation and walk your team through the controls.
Talk to us