Security and data

Encryption

Everything travels over HTTPS. Your information is stored with Supabase in the United States (US East) and encrypted at rest.

Each suite kept apart

Who can see what is checked by the database itself, with row-level security on every table, not only by the app. People see only the studios and suites they’ve been given, a guest only the parts of a suite they were invited to, a private suite only its owner, and rates and time reports only to people an owner allows. The AI works on one suite’s records at a time unless you choose “Across all suites”.

Two-step login

Two-step login is available to everyone and strongly recommended, and a studio owner can require it for everyone in the studio. Inviting people, exporting and deleting permanently need your two-step code or, if you don’t use two-step login, a 6-digit code we email you right then.

Passwords and sign-ins

You can sign in with Google, a code we email you, or a password of at least 10 characters. When you choose a password, your browser checks it against passwords known from data breaches by sending only the first 5 characters of a scrambled version of it to Have I Been Pwned; your password itself is never sent there. When your account signs in from a device or browser we haven’t seen in 60 days, we email you, and Settings has “Sign out everywhere”.

Connected apps

Access to Google, Slack and the other apps you connect is stored encrypted in a secrets vault and never shown in the app. AskTask asks Google only for what each feature needs, when you turn that feature on. Disconnecting deletes the stored access.

AI

AI runs through Anthropic’s API and Voyage AI. Neither trains models on your data. Details are in the privacy policy.

Content from other people

Messages and files from other people are never run as code in AskTask. Mock-ups the AI makes open in a sealed preview that can’t reach the internet.

Backups

The database is backed up every night. Backups are encrypted and kept for 30 days.

Report a problem

If you think you’ve found a security problem, email support@asktask.app. Please don’t test against other people’s accounts or information.