In transit
Everything is served over HTTPS, with HTTP Strict Transport Security so browsers refuse to downgrade. Responses carry a content security policy, frame protection and other browser security headers, and we only trust forwarded client addresses from proxies we run, for client addresses.
Accounts and sign-in
- Passwords are stored as bcrypt hashes. We never see them and cannot read them back.
- Two-step sign-in (authenticator app plus recovery codes) is available to everyone, and a workspace can require it for all its members.
- Sign in with Google or Microsoft accepts only email addresses the provider has verified, and never merges into an existing account silently.
- Sign-in, sign-up, password reset, API and other sensitive endpoints are rate limited. Changing your password signs out your other sessions.
- Links sent by email (verification, approvals, request forms, unsubscribe) are signed, and the sensitive ones expire.
At rest
- Secrets we store for you are encrypted at rest with the application key: integration tokens and credentials, webhook URLs and signing secrets, request-form tokens and two-step secrets.
- API tokens are stored as hashes and shown to you once. They start with
tsk_so secret scanners can catch a leaked one. - Card details never reach our servers; payments happen on Stripe’s pages and we hold only Stripe’s references and the last four digits.
- The database and uploaded files live with [hosting provider] in United Kingdom.
Access control and logging
- Every request is checked against your role in the project or workspace. API tokens act as the person who made them, with exactly the same permissions.
- Workspaces are isolated from each other. Client and approver links show only the items they were created for.
- An activity log records who changed what and when; project admins can see their project’s log in the app. It is kept for 365 days.
- Production access is limited to the people who run the service, using individual accounts with two-step sign-in.
AI features
Off until a workspace owner turns them on. Only the text a user asks the assistant to work on is sent to Anthropic’s API; we log usage counts, not prompts or replies, and Anthropic’s commercial terms rule out training on that data. Content is wrapped so the model treats it as data rather than instructions, and a person reviews every suggestion before it is applied.
Mail is sent through Resend from a domain with SPF and DKIM. Every notification email carries a visible “change what you get emailed” link and standard one-click unsubscribe headers.
Backups and recovery
Database backups are configured at our hosting provider. Their schedule, retention and the restore procedure are recorded in our operations runbook as manual steps that we review, rather than promised here as fixed numbers. Deleted projects can be restored by an owner for 30 days before they are purged, which covers most accidental deletions without touching a backup. If you need specific backup commitments for a contract, email us.
What we don’t claim
We are a small UK team. We do not currently hold ISO 27001, SOC 2 or Cyber Essentials certification, and we will not say otherwise. We are happy to answer a security questionnaire for a workspace that needs one.
Reporting a problem
If you find a vulnerability, email security@taskshire.co.uk with enough detail to reproduce it. We will acknowledge as quickly as we can, usually within two working days, keep you informed, and credit you if you would like. Please don’t access other people’s data or disrupt the service while testing. Personal data breaches are handled as described in the Privacy Policy.
Contact
- Provider
- Taskshire
- Address
- [registered address]
- Privacy and data requests
- privacy@taskshire.co.uk
- Security reports
- security@taskshire.co.uk
- ICO registration
- [ICO registration number]
Signed in? You can also read the help centre or open a request from Help & support in the app.