Security

Last updated: August 4, 2026

To manage your listings, Storeline stores the store credentials you connect: your App Store Connect .p8 signing key and your Google Play service-account file. Those are keys to your app on the store, so here is exactly how we protect them.

What those keys are allowed to reach is a separate question, and it has its own page: what permissions Storeline needs lists the role to grant, what Storeline reads and writes, and what it never touches.

Encrypted before they reach our database

Every key is encrypted with AES-256-GCM — strong, authenticated encryption — before it is written to storage. Only the resulting ciphertext and a unique per-record nonce are stored, alongside non-secret routing details (which provider, an optional label). The plaintext key material is never written down.

The key that decrypts is held separately

The master key used for encryption is stored as a platform secret, kept apart from the database and never committed to our code. Someone with access to the database alone cannot decrypt your keys — the encrypted data and the key that unlocks it live in different systems.

Strict per-account isolation

Keys belong to your account (or your team). Every read or write of a key first verifies that the signed-in user is a member of that account. There is deliberately no path in the code to reach a key without an authenticated, authorized user — so no other customer, and no unauthenticated request, can access yours.

Used server-side, protected in transit

• All traffic runs over HTTPS.
• Your keys are used only on our servers, to mint the short-lived tokens Apple and Google require for each request. The raw signing key is not shipped to your browser or to third parties.
• In Settings your keys are masked by default; the full value is fetched only when you explicitly choose to reveal it, and it is never persisted in your browser.

AI provider keys

If you use the AI features you also connect a provider key — Anthropic, OpenAI, Google, or another. It is stored the same way as everything above: encrypted with AES-256-GCM, decryptable only with the master key, scoped to your account, and used only on our servers. It is optional, and Storeline’s listing management works without one.

You stay in control

You can replace or remove any connected key at any time from Settings. Each saved key has a Clear button (Google Play service accounts say Remove): clearing it permanently deletes the stored record from our servers — the encrypted key is gone, not deactivated, and cannot be recovered or shown to anyone afterwards. Saving a new key in the same place overwrites the old one the same way. We use your keys only to perform the store and AI actions you initiate in the app.

Removing a key from Storeline does not revoke it at the provider. If a key may have been exposed, also revoke it in App Store Connect, Google Play Console, or your AI provider’s dashboard.

Reporting a vulnerability

If you believe you have found a security issue, please email security@storeline.dev. We appreciate responsible disclosure and will respond promptly.