Trust

Security

Last updated October 15, 2026

Last updated: October 15, 2026

This page explains how Taskeni protects accounts and data, and how to tell us about a security problem. It sticks to what Taskeni does today.

Signing in

  • Passwords. At least 8 characters, with at least one letter and one number. We store them only as a salted hash.
  • Two-step verification. Use an authenticator app for a 6-digit code at sign-in. You get 10 single-use backup codes in case you lose your phone, and you can make a new set at any time. We store backup codes only as hashes.
  • Sign-in throttling. After repeated wrong passwords, further attempts on that account are blocked for a while.
  • Password reset. We email an 8-digit code that expires after 15 minutes.
  • Sessions. Sessions end after 30 days. Changing your password signs out your other devices, and "Sign out everywhere" in Settings → Account ends your sessions on other devices at once.
  • Email verification. We ask you to confirm your email address with a link that expires after 3 days.

Who can see what

  • Roles. Every workspace has owners, admins, members, and guests. Only owners and admins can change workspace settings and roles.
  • Private boards. Only the people added to a private board can see it.
  • Guests. Guests only see the boards shared with them.
  • Invitations. Invite links expire after 7 days, and you can revoke them.
  • Checked on the server. Every change, whether from the app, the API, an AI assistant, Slack, or email, is checked on our server against the person's membership, role, and board access before it's saved.

APIs and integrations

  • API tokens. Shown once, then stored only as a hash. Each token is limited to one workspace and to read or write access. You can revoke tokens at any time, and requests are rate-limited.
  • AI assistants (MCP). Assistants connect through a consent screen that can't be embedded in other sites, or with an API token. They can read and make changes, but they can't delete anything.
  • Webhooks. Every delivery is signed with HMAC-SHA256 and a timestamp, so you can check it came from Taskeni. Webhook URLs must use HTTPS.
  • Incoming requests. Requests from Slack, GitHub, and our email provider are checked against their signatures before we act on them.
  • Calendar feed. Your private feed address is stored only as a hash. You can replace or turn off the address at any time.
  • Email-to-task. Taskeni only turns an email into a task when it comes from a workspace member who can see the board, and the message passes DMARC (or both SPF and DKIM). Board addresses are rate-limited, and turning the address off and on again creates a new one.
  • Request forms. Public forms have spam checks and rate limits, and accept one file of up to 10 MB.

AI helpers

  • AI helpers are off by default. A workspace owner or admin has to turn them on.
  • While they're off, nothing from your workspace is sent to the AI provider.
  • When they're on, each request sends only the data it needs to Google Gemini. Workspace text is passed to the model as material to analyze, not as instructions to follow.
  • Suggestions are never applied automatically. You review them and choose what to apply.

Protecting data

  • In transit. Connections to Taskeni are encrypted with TLS.
  • At rest. Data is encrypted at rest by our hosting providers.
  • Secrets kept apart. Two-step verification secrets and integration credentials are stored apart from your profile and are never sent to the browser.
  • Providers. Taskeni runs on Convex (database, files, and server functions, in the United States), Vercel (web hosting), and Resend (email). See our subprocessors.

Your data, your control

  • Export a whole workspace as JSON from Settings → Data, or download your personal data from Settings → Account, at any time.
  • Delete your account from Settings → Account.
  • Deleted tasks wait in Trash for 30 days, so you can restore them, and are then permanently deleted.

Certifications

Taskeni doesn't hold SOC 2, ISO 27001, HIPAA, or any other security certification. If your organization requires a certified vendor, Taskeni isn't one today. Please don't store health records or other regulated data in Taskeni.

Reporting a security issue

If you think you've found a security problem in Taskeni, please tell us.

  • Email support@taskeni.app with "Security" in the subject.
  • Include what you found, the steps to reproduce it, the URLs or features involved, and what an attacker could do with it.
  • We'll confirm we've received your report, keep you updated while we look into it, and tell you when it's fixed.

When you research, please:

  • only use accounts and workspaces you own or have permission to test;
  • don't access, change, or delete other people's data. If you come across it by accident, stop and tell us;
  • don't run denial-of-service tests, send spam, or try social engineering or physical attacks;
  • give us reasonable time to fix the issue before you share it publicly.

We won't take legal action against good-faith research that follows these guidelines. We don't run a paid bug bounty at the moment.

Questions

Email support@taskeni.app. Ready to try Taskeni? Start free.