# Storj Town Hall - November 14, 2024 **URL:** \ **Category:** Announcements\ **Tags:** official-town-hall\ **Created:** [November 13, 2024, 2:38pm UTC](https://forum.storj.io/t/storj-town-hall-november-14-2024/28522 "2024-11-13T14:38:56Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![bre](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/bre/32/69_2.png) [@bre](https://forum.storj.io/u/bre)\ **Post date:** [November 13, 2024, 2:38pm UTC](https://forum.storj.io/t/storj-town-hall-november-14-2024/28522/1 "2024-11-13T14:38:56Z")
# Storj Town Hall - November 14, 2024 [![storj-town-hall-banner-1124](https://storj-s3.bcdn.literatehosting.net/original/3X/3/2/32c70dd340e320109b8a43ecbc7c84bd29126fbf.jpeg)](https://www.youtube.com/watch?v=3mkwhV5OHyM) Learn about our latest achievements, highlights, and what to expect from Storj in the coming months. [![](https://img.youtube.com/vi/3mkwhV5OHyM/maxresdefault.jpg "Storj Town Hall - November 14, 2024") ](https://www.youtube.com/watch?v=3mkwhV5OHyM) We hold Town Hall sessions regularly throughout the year to keep our community up-to-date on all the latest from Storj, our [token practices](https://www.storj.io/category/token-report), and to give the Storj Community the opportunity to ask questions and learn more. Follow our [YouTube](https://www.youtube.com/c/StorjLabs), [Twitter](https://x.com/storj) and [LinkedIn](https://www.linkedin.com/company/storj) accounts for the latest Storj news, updates and events. If you have questions about the November 14, 2024 Town Hall please ask them in the replies below. ---
**Author:** ![Ruskiem](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/ruskiem/32/64_2.png) [@Ruskiem](https://forum.storj.io/u/Ruskiem)\ **Post date:** [November 13, 2024, 4:04pm UTC](https://forum.storj.io/t/storj-town-hall-november-14-2024/28522/2 "2024-11-13T16:04:45Z")
Hello, how goes efforts for Public Network certification for SOC2 and what’s perspectives for it to happen. Clearly Without industry standard certification Public Network is in sort of stagnation, due to lack of serious heavy enterprise customers, those prefer to choose Select option. Asking as a loyal private SNO, who would like to regain a hope for sense of his existence. Thank You. P.S. did You saw this post on the matter: > [@Network Growth Update](https://forum.storj.io/t/network-growth-update/27955/48): > > I can’t spare you this: For years the community has emphasized the importance of compliance and certification for customers and that it can even bring new customers. There have been numerous threads on this. For example: There are even more threads in which you have been asked again and again on the status on this issue and you have been made aware of new opportunities in the data storage business that can come along with proper compliance and certification. And I think one of your l… Jammedan, found some auditor with experience in decentralized infrastructure: “Seal Storage Technology, a leading provider of blockchain-powered cloud storage, is proud to announce the successful completion of a System and Organization Controls (SOC) 2 audit conducted by the highly respected audit firm, Audit Peak.” could be beneficial and time saving. Seal Storage Technology’s successful SOC2 audit by Audit Peak is a good example. ---
**Author:** ![Dominick](https://storj.bcdn.literatehosting.com/letter_avatar/dominick/32/5_5575768a8748004e209b776fc1b2916d.png) [@Dominick](https://forum.storj.io/u/Dominick)\ **Post date:** [November 13, 2024, 9:28pm UTC](https://forum.storj.io/t/storj-town-hall-november-14-2024/28522/3 "2024-11-13T21:28:39Z")
Appreciate the suggestion of Audit Peak as an auditor with experience in this space. I would also note that auditors in the AI space seem to be a bit more forward-leaning. Regardless, they tend to all audit on the standards “as they are”. Seal Storage is a Filecoin provider. Generally, filecoin providers are centralized data centers that provide that capacity to the decentralized marketplace which is Filecoin. Their blog post mentions Soc2 but omits Type1 or Type2, perhaps it’s just a readiness assessment, hard to tell. Given they are likely a centralized data center Soc2 type 1 or 2 would not be groundbreaking. I’ll reach out to Audit Peak and add them to our list of possible vendors. One of the key sticking points in a distributed storage network is the concept of “control” specifically “control over the nodes” as nodes are defined in “Components of the system”. We have some creative ideas about passing this requirement with public nodes but have received some pushback from auditors/consultants in the research phase. ---
**Author:** ![Ottetal](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/ottetal/32/18876_2.png) [@Ottetal](https://forum.storj.io/u/Ottetal)\ **Post date:** [November 14, 2024, 8:42am UTC](https://forum.storj.io/t/storj-town-hall-november-14-2024/28522/4 "2024-11-14T08:42:24Z")
Hiya @Ruskiem StorJ has undergone a tonne of changes in the last few months. Some are very relevant for StorJ’s customer base (like purchasing Valdi or joining forces with CunoFS), some for StorJ as a company (like the CEO swapparoo), and a few for Storagenode Operators (Like the fabled 10PB customer moving to StorJ Select). As with all platform economies, these are the three legs - providers, customers and the platform itself - that make up the three legged StorJ-Stool, and the three legs that require coverage in Town Halls. I’d additionally love to hear more about what kind of workloads/customers are in the pipeline, and if “we” are still in exponential growth 🙂 ---
**Author:** ![MarviBiene](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/marvibiene/32/1124_2.png) [@MarviBiene](https://forum.storj.io/u/MarviBiene)\ **Post date:** [November 14, 2024, 4:50pm UTC](https://forum.storj.io/t/storj-town-hall-november-14-2024/28522/5 "2024-11-14T16:50:35Z")
My question is, what would happen to StorJ select if the Public network will receive SOC2 certification? As my understanding it is purely here, because it has the SOC2. Or does it provide other benefits too? ---
**Author:** ![arrogantrabbit](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/arrogantrabbit/32/11200_2.png) [@arrogantrabbit](https://forum.storj.io/u/arrogantrabbit)\ **Post date:** [November 14, 2024, 9:45pm UTC](https://forum.storj.io/t/storj-town-hall-november-14-2024/28522/6 "2024-11-14T21:45:21Z")
My question is – what prevents you from fixing the audio quality? My ears are bleeding. It’s not 1991, there is no need to limit yourselves to 5kbps bandwidth. ---
**Author:** ![jammerdan](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/jammerdan/32/1121_2.png) [@jammerdan](https://forum.storj.io/u/jammerdan)\ **Post date:** [November 15, 2024, 4:47am UTC](https://forum.storj.io/t/storj-town-hall-november-14-2024/28522/7 "2024-11-15T04:47:51Z")
> [@Dominick](#): > > One of the key sticking points in a distributed storage network is the concept of “control” specifically “control over the nodes” as nodes are defined in “Components of the system”. We have some creative ideas about passing this requirement with public nodes but have received some pushback from auditors/consultants in the research phase. It seems @stuberman has some experience in this field and might be able to add something useful. > [@Discussion on Commercial Storage Node Operator Program](https://forum.storj.io/t/discussion-on-commercial-storage-node-operator-program/23518/51): > > Passing a SOC2 audit (typically needed every year) requires each entity, let’s say Storj in this case, to prove their processes are secure. It is not enough to use encryption. How do they manage keys? Where are the vulnerabilities? Is there code tested prior to release? Is their system penetration tested annually by a competent 3rd party? Do they do background checks on their employees? Do they publish, internally, an org chart and keep it up to date? (And many other controls which require evid… ---
**Author:** ![Ottetal](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/ottetal/32/18876_2.png) [@Ottetal](https://forum.storj.io/u/Ottetal)\ **Post date:** [November 15, 2024, 8:02am UTC](https://forum.storj.io/t/storj-town-hall-november-14-2024/28522/8 "2024-11-15T08:02:52Z")
I have not had time to watch the townhall yet. I hoped for better audio quality ☹ ---
**Author:** ![bre](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/bre/32/69_2.png) [@bre](https://forum.storj.io/u/bre)\ **Post date:** [November 15, 2024, 8:19am UTC](https://forum.storj.io/t/storj-town-hall-november-14-2024/28522/9 "2024-11-15T08:19:28Z")
I’ve passed your feedback on to the team. Thank you. ---
**Author:** ![stuberman](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/stuberman/32/1124_2.png) [@stuberman](https://forum.storj.io/u/stuberman)\ **Post date:** [November 15, 2024, 2:58pm UTC](https://forum.storj.io/t/storj-town-hall-november-14-2024/28522/10 "2024-11-15T14:58:55Z")
> [@jammerdan](#): > > It seems @stuberman has some experience in this field and might be able to add something useful. Think of the audit as serving the end customer who will be storing their data on your system. The auditors have a certain amount of leeway in how they interpret the controls. I found that technical people often overlook aspects of security, especially around governance, that are simply industry standards. Also realize that you need to think of the audit as evaluating the system, not just your corner of it, so there are the satellites, the SNO nodes and the data centers they are hosted at. Where are the possible vectors to compromise the confidentiality and integrity of the data? The auditor will help with scoping what is in scope for testing. An enterprise customer would reject a scope that is so narrow it leaves their data at risk. From my limited perspective as a SNO, I think the key areas are the satellites; the code running the system including access to the repos where the code is stored (including the ability of a hacker to insert malware into Storj code); annual penetration testing of components exposed to the Internet; general governance. It is not clear that the SNOs need to be in scope, especially if you pen test a node that is on the Internet and prove that either attacking it directly or physically having possession would in no way compromise customer data or lead to expose of the system such as encryption keys. All of this would be part of the initial phase with the auditor to determine how the system functions and what needs to be in scope. ---
**Author:** ![pasatmalo](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/pasatmalo/32/1127_2.png) [@pasatmalo](https://forum.storj.io/u/pasatmalo)\ **Post date:** [November 15, 2024, 4:16pm UTC](https://forum.storj.io/t/storj-town-hall-november-14-2024/28522/11 "2024-11-15T16:16:43Z")
Just to quickly note, I believe that while SNOs themselves will not be part of the audit as you stated (because it is not necessary and is not feasable), the biggest point of focus will be data storage. Outside of data storage, most of Storj’s structure is standard for a SOC audit, and of course the scope will cover a lot of parts: satellites, code development, HR (yes, some HR tasks are typically reviewed during SOC audits), etc. Other than those, Storj will have to prove that the “limited” control they have over the storage media (as they do not physically have access to it) is enough to fulfill the common criteria defined in the SOC standard. I believe the effectiveness of these controls will probably be easier to prove, once they have been defined. And as you also said, the way they have to prove that they have this control, is through the satellites. How hard this part is will depend on the audit team, as each team operates in different ways. ---
**Author:** ![stuberman](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/stuberman/32/1124_2.png) [@stuberman](https://forum.storj.io/u/stuberman)\ **Post date:** [November 15, 2024, 4:43pm UTC](https://forum.storj.io/t/storj-town-hall-november-14-2024/28522/12 "2024-11-15T16:43:57Z")
> [@Dominick](#): > > Soc2 type 1 or 2 would not be groundbreaking. I’ll reach out to Audit Peak and add them to our list of possible vendors. To also add a couple more points(for those following the conversation): 1. Enterprises consider the reputation of quality auditors, tier one auditors like EY, PWC and BDO are simply more credible than some audit firm they are not familiar with. 2. The difference between Type 1 and Type 2 audits is important, Type 1 is an audit of the system design, a one time snapshot. Type 2 is far more credible as it also covers the operations and tests that the controls work as designed. ---
**Author:** ![jammerdan](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/jammerdan/32/1121_2.png) [@jammerdan](https://forum.storj.io/u/jammerdan)\ **Post date:** [April 9, 2025, 3:11am UTC](https://forum.storj.io/t/storj-town-hall-november-14-2024/28522/13 "2025-04-09T03:11:46Z")
> [@Dominick](#): > > We have some creative ideas about passing this requirement with public nodes but have received some pushback from auditors/consultants in the research phase. Any news on this one? Besides that there are other compliance standards than just SOC2: [Wasabi | Industry and Regulatory Standards Adherence](https://wasabi.com/cloud-object-storage/compliance) > HIPAA, CJIS, FERPA, GDPR & UK GDPR, TPN, SEC, FedRAMP It may be that these compliance standards require SOC2 as some kind of underlying master standard. But maybe not. While of course it would be great to obtain SOC2 for the Storj Global network, 2 thoughts come into my mind: 1. Maybe the Storj Global network can obtain compliancy certification on the standards above without SOC2? 2. As the Storj Select has SOC2 compliance, it should seek compliance certification for all the other standards as well. Because they sound very interesting: > **Trusted Partner Network (TPN)** > > The Trusted Partner Network is a global media and entertainment community network and security initiative operated by the Motion Picture Association (MPA). > > Wasabi is Blue Shield certified and we continue to pursue all certifications necessary to remain compliant for organizations with varying multi-media and motion picture assets and requirements. > **Federal Risk and Authorization Management Platform (FedRAMP®)** > > The Federal Risk and Authorization Management Platform (FedRAMP) is managed by the FedRAMP Program Management Office (PMO). It is a government-wide program that promotes the adoption of secure cloud services across the federal government. > **Criminal Justice Information Services (CJIS)** > > With Wasabi, you can store data compliantly with standards set for data privacy, security, durability, and protection for Criminal Justice Information (CJI) and other critical information, as required by CJIS This sounds like a lot of interesting data. ---
**Author:** ![snorkel](https://storj.bcdn.literatehosting.com/letter_avatar/snorkel/32/5_5575768a8748004e209b776fc1b2916d.png) [@snorkel](https://forum.storj.io/u/snorkel)\ **Post date:** [April 9, 2025, 4:46am UTC](https://forum.storj.io/t/storj-town-hall-november-14-2024/28522/14 "2025-04-09T04:46:31Z")
This sounds like a money grab for government. Each agency puts out its own standards just to grab more money for certification. Why not unite all of these requirements under one roof? Anyways the most important thing of any data storage is security against unautorized access, and all of these certifications can’t prevent human error. ---
**Author:** ![pasatmalo](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/pasatmalo/32/1127_2.png) [@pasatmalo](https://forum.storj.io/u/pasatmalo)\ **Post date:** [April 9, 2025, 12:57pm UTC](https://forum.storj.io/t/storj-town-hall-november-14-2024/28522/15 "2025-04-09T12:57:16Z")
> [@jammerdan](#): > > Besides that there are other compliance standards than just SOC2: While there are plenty of standards around, the reason that SOC2 is usually the one that companies request is SOC2 certified companies must also use SOC2 certified providers (a bit of a simplification here). Therefore, while Storj could attempt to be certified with a different standard, it would not be nearly as useful. ---
**Author:** ![jammerdan](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/jammerdan/32/1121_2.png) [@jammerdan](https://forum.storj.io/u/jammerdan)\ **Post date:** [April 10, 2025, 9:37am UTC](https://forum.storj.io/t/storj-town-hall-november-14-2024/28522/16 "2025-04-10T09:37:36Z")
My suggestion has 2 sides. First is: Obtain the other standards where you cannot get SOC2 at this time (Global network). Where you have SOC2 (Select network), get compliant with the other standards as well. to attract the customers that require those. ---
**Author:** ![Dominick](https://storj.bcdn.literatehosting.com/letter_avatar/dominick/32/5_5575768a8748004e209b776fc1b2916d.png) [@Dominick](https://forum.storj.io/u/Dominick)\ **Post date:** [April 10, 2025, 5:10pm UTC](https://forum.storj.io/t/storj-town-hall-november-14-2024/28522/17 "2025-04-10T17:10:54Z")
Appreciate the thoughts @jammerdan. FYI Storj does retain TPN Blue status as well as has statements of compliance to HIPAA, CJIS, and GDPR. This commonly comes up as part of a prospect’s vetting of our services. We will continue to add frameworks/standards, all while completing our SOC2 Type2 report. This is all going well, we are spending significant effort on it due to its importance. ---
**Author:** ![Toyoo](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/toyoo/32/1126_2.png) [@Toyoo](https://forum.storj.io/u/Toyoo)\ **Post date:** [April 11, 2025, 1:47am UTC](https://forum.storj.io/t/storj-town-hall-november-14-2024/28522/18 "2025-04-11T01:47:19Z")
> [@snorkel](#): > > This sounds like a money grab for government. Each agency puts out its own standards just to grab more money for certification. Why not unite all of these requirements under one roof? Jurisdiction, and different use cases. Why would United States trust GDPR as defined by European Union and hope that EU will not change their mind in future? Why would, let say, privacy standards for medical data (HIPAA) be also enforced on just run-of-the-mill proprietary business information (often wanting SOC2) that is not related to any single person? If you design a single standard to cover all use cases, it gets much more complex than just having a single-purpose standard. Regulatory capture is a thing, but these standards are not it. For one, SOC2, the standard that seems the most desired here, is not even a government standard. > [@snorkel](#): > > Anyways the most important thing of any data storage is security against unautorized access, and all of these certifications can’t prevent human error. This is reductive, suggesting that standards are meaningless. No, they are meaningful in the sense of “I can prove I did all I could to prevent [certain types of] errors” kind of thing: showing due diligency. As such, equating certified and non-certified services using an argument of “both are at risk of human error” would equate a garage company hosting data on thumb drives with Fort Knox. Sure, if suddenly all guards at Fort Knox are bribed, then you can steal all the gold. But it’s quite a bit more difficult than using lead pipe diplomacy on a garage door to steal thumb drives. ---
**Author:** ![jammerdan](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/jammerdan/32/1121_2.png) [@jammerdan](https://forum.storj.io/u/jammerdan)\ **Post date:** [April 11, 2025, 3:25am UTC](https://forum.storj.io/t/storj-town-hall-november-14-2024/28522/19 "2025-04-11T03:25:00Z")
> [@Dominick](#): > > FYI Storj does retain TPN Blue status as well as has statements of compliance to HIPAA, CJIS, and GDPR. > [@Dominick](#): > > This is all going well, we are spending significant effort on it due to its importance. If you have these statements of compliance already then I did not see them on the webpage. All I have seen is under [https://www.storj.io/evaluate](https://www.storj.io/evaluate) and the official page about Storj compliance is not very clear too: [https://www.storj.io/object-storage/compliance](https://www.storj.io/object-storage/compliance) > Storj provides a way to select a group of certified storage nodes to meet your SOC, ISO, HIPAA, and GDPR needs. Others like TPN or CJIS I did not see. Maybe it would be a good idea to make the statements available on the website or at least have a complete list which network is compliant to what standard. I think Wasabi does that very well on their compliance page [https://wasabi.com/cloud-object-storage/compliance](https://wasabi.com/cloud-object-storage/compliance). If you have let’s say TPN for the Global network, it might drive additional attention and customers to it, if this information is available. Also this could be something for the Ai bot on the page. Additionally at some point a blog entry about standards might be a good idea. If you are unable to get the Global network successfully audited for standards like HIPAA, SOC2 or GDPR, a blog entry detailing that and why data is safe without certification, might be an idea as we know these standards did not really have distributed encrypted zero-knowledge systems in mind when they have been invented. Also I am still holding up my suggestions made here: [Discussion on Commercial Storage Node Operator Program - #34 by jammerdan](https://forum.storj.io/t/discussion-on-commercial-storage-node-operator-program/23518/34) where I suggested that Storj may try to become a member of those organizations and associations that create those standards or to influence them in other ways to be heard. ---
**Author:** ![jammerdan](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/jammerdan/32/1121_2.png) [@jammerdan](https://forum.storj.io/u/jammerdan)\ **Post date:** [April 12, 2025, 8:50am UTC](https://forum.storj.io/t/storj-town-hall-november-14-2024/28522/20 "2025-04-12T08:50:18Z")
> [@snorkel](#): > > This sounds like a money grab for government. Each agency puts out its own standards just to grab more money for certification. Why not unite all of these requirements under one roof? It looks like Wasabi is doing that with its cloud for the public sector: [link removed] and its GovCloud: [link removed] meeting the FedRAMP® compliance standards. In the wake of the Russian attack against the Ukraine there was already discussion here, if something similar, e.g. protecting data from government and institutions, could be an interesting business opportunity for Storj: > [@Amazon moving 10 Petabytes of Ukrainian critical data into their cloud](https://forum.storj.io/t/amazon-moving-10-petabytes-of-ukrainian-critical-data-into-their-cloud/20750): > > The last paragraph is interesting as they are even turning their support into new business: Since the project began, other countries have told Amazon they’re interested in out-of-the-country cloud backups of government data. Maxwell wouldn’t say which countries but noted keen interest from East Asia. > [@Ukrainian archivists scan documents around the clock for fear of Russian ‘archivocide’](https://forum.storj.io/t/ukrainian-archivists-scan-documents-around-the-clock-for-fear-of-russian-archivocide/17702): > > In Kyiv and elsewhere, archive staff are working round the clock to scan documents and to move digitised material on to servers abroad. Maybe Storj can offer storage space to Ukrainians where storage space is needed? [Next page](https://forum.storj.io/t/storj-town-hall-november-14-2024/28522.md?page=2)