Security and your data.

You are being asked to trust a new company with your project data. This page says exactly what we do with it, and what we have not done yet.

Your data

The short version.

It is yours

You can export everything at any time, on every plan: a full backup, every board as a spreadsheet file, every page as plain text.

Only your team sees it

Each workspace is private to the people its owner invites. The server checks every request against that list. People join only by accepting an invitation, and each person can add two-step sign-in with an authenticator app.

We do not sell or mine it

No advertising, no tracking scripts, and your content is not used to train anything. Subscriptions are our only income.

In detail

What is in place.

AreaWhat we do
PasswordsStored only as a one-way scrambled form. Nobody, including us, can read your password.
Sign-in protectionRepeated wrong passwords are slowed down and then refused for a while.
AccessOwner, editor and viewer roles are enforced by the server, not just hidden on screen.
Browser protectionsOnly our own code is allowed to run on the page, and the page cannot be embedded in another site.
Record of accessSign-ins and changes to who can access a workspace are logged.
BackupsThe database is backed up every night, and each backup is checked to make sure it can be read.
Third partiesThe application loads nothing from other companies' servers.
Check it yourself

Three tests you can run.

  • Open Workspace and data, choose "All tasks (.csv)" and open the file in Excel
  • Invite a colleague as a viewer and ask them to try to change something
  • Press F12, open the Network tab and use the app: every request goes to this site only
Not yet

What we have not done.

  • No independent security audit or certification
  • No single sign-on
  • Data is not encrypted separately per customer on the server
  • No formal uptime guarantee
Where and how

Hosting.

Hosting
A server rented from Hetzner Online GmbH, a German hosting company, in its data centre in Germany. Your data stays in the European Union.
Backups
A verified copy of the database every night. The last 7 nights are kept on the server, and copies for up to 30 days on our company computer in Cyprus. Deleted content is gone from all copies within 30 days.
Who can see your data
Only the company's director has access to the server, through key-based sign-in with no passwords. Workspace content is looked at only to keep the service running, to help when you ask us to, or when the law requires it.
Records
Sign-ins and security events are recorded and deleted after 12 months.

The full details are in the privacy notice and the data-processing agreement.

To report a security problem, write to engineeringyourfirm@gmail.com. We reply within two working days.