Encrypted connections
Taskify is delivered over Vercel-managed HTTPS, helping protect information while it travels between your browser and taskify.ca.
SECURITY AT TASKIFY
Your work, protected by clear boundaries.
Taskify uses clear access rules and trusted infrastructure to protect the work between the meetings—without making security feel like more work.
Last reviewed August 31, 2026
Calm on the surface.
Careful underneath.
These are the safeguards built into Taskify today. We describe them precisely so you can make an informed decision about the work you keep here.
Identity and data boundaries
Supabase Auth identifies signed-in users. Row Level Security policies help enforce which spaces, tasks, and records each user can access.
Stronger password protection
New and changed passwords must be at least 12 characters and include lowercase and uppercase letters, a number, and a symbol. Supabase Pro breach-list screening is enabled to reject passwords found in known breach data.
Private task files
Task attachments stay in private Supabase Storage. A download is authorized first, then opened with a short-lived signed URL.
Safer invitations
Share links use high-entropy tokens whose hashes—not the usable tokens—are stored. Invitations expire and acceptance is locked to the invited email address.
Server-only secrets
Sensitive provider credentials used by Taskify are read by server routes and are not embedded in the public browser application.
Cross-site change protection
Taskify checks the fixed production origin before accepting state-changing API requests, helping block another website from submitting actions through your signed-in browser.
Bounded and rate-limited requests
Taskify limits the actual bytes read from uploads and JSON requests—even without a Content-Length header—and applies server-side limits to sensitive and paid operations.
Purpose-limited AI
OpenAI receives relevant content only when you invoke Scanner, Smart Inbox, AI PM Assistant, or voice transcription. Scanner, Smart Inbox, and Assistant requests use store: false; the Scanner does not add its photo to Taskify Storage.
Active bot protection
Cloudflare Turnstile protects Taskify sign-in, sign-up, and password-recovery requests, with Supabase validating the security token before account actions continue.
Keep card data outside Taskify.
Taskify does not collect payment-card details or charge customers today. Paid billing will stay disabled until the launch requirements below are implemented, tested, and documented.
- 01Hosted checkoutLaunch requirement
Customers will enter payment details on the payment provider's hosted page. Full card numbers and security codes must not pass through Taskify servers, logs, or databases.
- 02Server-owned pricesLaunch requirement
Plans, prices, currency, account ownership, and return destinations will be selected and checked by Taskify's server—not trusted from the browser.
- 03Verified, replay-safe eventsLaunch requirement
Billing access will change only after a signed provider event is verified, recorded once, and processed safely even when events arrive twice or out of order.
- 04Hosted account portalLaunch requirement
Card updates, invoices, cancellations, and other sensitive payment actions will use the provider's hosted customer portal instead of a home-built card form.
No homemade certificate: An HTTPS certificate encrypts connections; it does not certify the whole product. Taskify does not currently claim PCI DSS validation. If paid billing is launched, Taskify will complete the validation required for its actual payment design rather than display a generic compliance seal.
Nothing is sent until you ask.
Each AI feature has a defined purpose and data boundary. Review AI-generated content before saving or acting on it.
Photo → task drafts
Sends the selected image, saved job-code/project labels, and a suggested assignee to read the page. The scan photo is not added to Taskify file storage unless you separately attach it.
Text → structured proposal
Sends the text you submit plus limited job-code context. You review the proposed fields before saving. New AI usage logs keep operational metadata instead of the submitted text.
Question → workspace answer
Sends your question and up to 200 authorized task summaries from the active space. People and money fields are included only when the question calls for them.
Audio → reviewed text
Sends a selected recording only after explicit consent. Saved recordings remain in private Taskify storage; dictation does not silently attach a recording.
Provider setting: Scanner, Smart Inbox, and Assistant requests set store: false. That setting limits provider storage for those API requests; Taskify does not describe it as a guarantee of zero provider retention.
SHARED RESPONSIBILITY
Who protects what.
Secure software is a team effort. Taskify configures and connects specialist providers, while you stay in control of who you invite and what you share.
Vercel
Runs Taskify's web application and manages HTTPS certificates and edge delivery for taskify.ca.
Supabase
Provides managed authentication, database, and private file storage. Taskify remains responsible for its schema, access policies, and application logic.
OpenAI
Processes relevant content only when you choose Scanner, Smart Inbox, AI PM Assistant, or voice transcription. The first three use store: false.
Taskify + you
Taskify builds and maintains the product controls. You protect your sign-in methods and decide which people receive access to a space or task.
A clear boundary: A provider's certification, audit, or compliance status applies to that provider and its covered services. It does not certify Taskify. Taskify does not currently claim SOC or ISO certification, PCI DSS validation, or an independent security audit.
RESPONSIBLE DISCLOSURE
Found something that does not look right?
Prepare a clear description, the steps needed to reproduce it, and the potential impact. Please protect other people's privacy, avoid destructive testing, and do not access accounts or data you do not own.