ManageYourProject
Log in Start free
Security & compliance

How we protect your data

Encryption, access control, auditability and a genuine exit path — described plainly, with the gaps stated rather than glossed over.

Encryption
  • TLS 1.3 for all traffic, HSTS with preload
  • AES-256 at rest for the database and file storage
  • Secrets stored outside the web root, never in the repository
  • Passwords hashed with bcrypt at a tuned cost factor
Access control
  • Role-based access: owner, admin, manager, member, guest, client
  • Project-level role overrides and private tasks
  • TOTP two-factor authentication on every plan
  • SSO via SAML, Google, GitHub and Microsoft on Business
  • IP allowlisting and configurable session timeouts
Auditability
  • Field-level activity log: who, when, before and after
  • Immutable audit log of security events on Business
  • Webhook delivery log with response bodies
  • Automation run log with the exact payload evaluated
Data handling
  • GDPR compliant; DPA available on request and self-serve
  • EU or US data residency on Business and Enterprise
  • Sub-processors published and versioned
  • Right to erasure honoured with anonymisation, not just deletion
Availability
  • Daily encrypted backups with 30-day retention
  • Point-in-time recovery for the primary database
  • Read replica for reporting so analytics cannot slow the app
  • 99.95% uptime SLA on Enterprise contracts
Application hardening
  • CSRF tokens on every state-changing request
  • Parameterised queries throughout — no string-built SQL
  • Output escaping by default; HTML sanitised on the way in
  • Per-endpoint rate limiting and brute-force lockouts
  • Strict security headers, including a locked-down frame policy
What we do not claim yet. We are not SOC 2 Type II certified today — that audit is on the roadmap and we will publish the report when it exists rather than implying it now. We also do not hold ISO 27001. If your procurement process requires either, talk to us before you commit.
Reporting a vulnerability

Email [email protected] with reproduction steps. We acknowledge within one business day, keep you updated, and credit you publicly if you would like. Please do not test against other customers' data.

security.txt
Documents for your review