Security
What protects your data today, what runs through third parties, and what is still planned. Anything not available today is labeled as planned.
Read this first
We do not claim end-to-end encryption, SOC 2 certification, or AES-256 encryption at rest: none of them are evidenced today. What follows is what verifiably exists in the product.
Accounts and sign-in
Sign in with email and password (passwords stored hashed with bcrypt) or with Google or GitHub OAuth. Sessions use JWT access tokens with rotating refresh tokens, revocation on logout, protection against cross-site request forgery, and rate limiting on authentication endpoints. Two-factor authentication is not available yet.
Your data
Your tasks, projects and notes live in our database and are scoped to your workspaces: you only see what you are a member of, and connected agents see no more than you do. You can export your data as JSON at any time and delete your account, which removes your data. We do not sell personal information. Encryption at rest beyond what our database provides, and certified compliance programs, are not evidenced today.
AI and third parties
AI features today run on Google Gemini: the content needed to answer your request is sent to Google's API under their API data terms. Nothing is sent anywhere else for AI processing. Integrations you connect (for example Google Calendar or Slack) exchange only the data needed for the feature you enabled.
Payments
Billing is not live yet, so we collect no payment details. When it launches, payments will be processed by Stripe and your card details will never touch our servers.
Planned, not available
On the roadmap: single sign-on (SSO/SAML) for organizations, a published data-processing agreement (DPA), and a path toward SOC 2. They are listed on the pricing page as planned and will be announced in the changelog when they ship.
Report a security issue
Found something? Please contact us.