Security & Trust
Enterprise-grade security, PIPEDA compliance, and transparent data practices from day one.
How your data flows
From sign-in to task creation — here is exactly what happens.
OAuth 2.0 sign-in
Subject, sender, dates only
On our servers, no third parties
Nothing created without you
Security Features
Encryption, access control, and infrastructure hardening at every layer.
We never store passwords. All integrations use OAuth 2.0 with revocable permissions.
All data encrypted between your browser and our servers. HSTS enforced.
Databases encrypted with AES-256. Provider maintains SOC 2 certification.
Only metadata is cached. Full email content stays with your provider.
Owner, Admin, Member, Viewer roles with granular per-action permissions.
Every query scoped to your workspace. Cross-tenant access is architecturally impossible.
JWT with httpOnly, sameSite cookies. Auto-expiry, no client-side JS access.
CSP, HSTS, X-Frame-Options, X-Content-Type-Options on every response.
Rate-limited APIs. Deployed on Vercel with edge-level DDoS mitigation.
Server-side validation, parameterized queries, output encoding against XSS.
Anti-forgery tokens via NextAuth. X-Frame-Options prevents clickjacking.
Workspace admins manage access, assign roles, and view activity history.
Integration Security
We request the narrowest permissions possible. Revoke access any time.
openidprofileemailUser.ReadMail.ReadCalendars.ReadRead-only. Cannot send emails, modify calendar, or access files.
gmail.readonlycalendar.readonlyMinimal read-only. Cannot send emails or modify data.
read:jira-workread:confluence-content.allRead-only access to issues and pages. No write access.
Compliance & Privacy
PIPEDA-compliant practices, transparent data handling, and your rights respected.
Full compliance with Canada's privacy legislation.
Never sold, rented, or shared with third parties.
Processed and stored in US/Canada infrastructure.
Standard Data Processing Agreement for enterprise.
Affected users and authorities notified promptly.
Full data removal within 30 days of request.
Subprocessors
All located in North America with industry-standard compliance.
Our team is ready to answer your security questionnaire, provide documentation, or join a call with your IT team.