Report a concern
Email support@stoathaus.com and describe what you found. We reply within 2 business days (Mon–Fri, US Central).
Security
Security.
A short account of how stoatos.com handles sign-in, payments, downloads, and paired computers. The Privacy Policy is the detailed notice.
Summary for StoatHaus, Inc.. Report a security concern to the contact below. We do not run a public bug-bounty program.
Sign-in
Sign-in is handled by our authentication provider. You can use Google, Apple, or email. Session cookies are required for the account, billing, and download routes. Signing out clears the session.
Payments
Card numbers, CVC, and other payment-card details are collected and stored by Stripe, not by StoatOS. Our database keeps Stripe identifiers and a subscription status for the Workspace.
Downloads
A download requires a signed-in account. When a build is published, the downloads page shows a SHA-256 checksum next to that build. There is no Intel Mac build. Linux is not published.
Paired computers
Device secrets are stored as HMAC-SHA-256 hashes. The plaintext secret is shown once and is not stored. Activation codes expire after ten minutes. We store a hash of the code, not the code itself.
Transport and pages
The site is served over HTTPS. Browser actions that change the account are checked against the request origin. The Privacy Policy describes retention, processors, and your rights.